Privacy Map

Colorado. Breach notification. Act

CO breach lawColorado data breach notification law (Colo. Rev. Stat. § 6-1-716 (private); § 24-73-103 (government))

In force
Partly verifiedMedium confidence. CCPA penalty figures from the Colorado Consumer Protection Act general penalty provision; not confirmed on fetched page. AG threshold stated as 500 or more.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Colorado residents to notify affected individuals after a security breach. Core timing rule: Individuals no later than 30 days after determining a breach. Covered data: name plus SSN, student/military/passport ID, driver's licence or ID card, medical and health insurance data, biometric data; online credentials; account numbers with codes.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

One of the shorter fixed deadlines (30 days) applied from determination; where another law sets a different deadline, the shorter one applies; pairs breach notice with data disposal and reasonable security duties.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Colorado requires the maintaining entity to notify and cooperate with the owner immediately if misuse occurred or is likely; covered entities must contractually require vendors to protect data. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals no later than 30 days after determining a breach; AG within 30 days if >=500 residents; CRAs if >1,000
DPO
No
Cross-border transfers
None
Maximum penalty
AG may seek civil penalties under the Colorado Consumer Protection Act (up to $20,000 per violation, $50,000 against elderly victims) plus damages and injunctions

§3Dates

Key dates
  • Adopted
  • In force
  • Overhauled by HB 18-1128 (eff. 2018-09-01): 30-day deadline, AG notice, data disposal and security duties

§4Text and authority

Text
Authority
Colorado Attorney General

§5Where it applies

Domestic law of
Colorado

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. CCPA penalty figures from the Colorado Consumer Protection Act general penalty provision; not confirmed on fetched page. AG threshold stated as 500 or more.