COLORADO Data Breach Notification Law
C.R.S. § 6-1-716; Colorado Privacy Act (CPA) C.R.S. §§ 6-1-1301 et seq.
Colorado's Protections for Consumer Data Privacy Act (C.R.S. § 6-1-716) was significantly updated in 2018 and again in 2023. Colorado now requires notification within 30 days of determining a breach has occurred — one of the shorter deadlines in the country. The 2023 Colorado Privacy Act also introduced comprehensive data privacy rights similar to California's CCPA. Companies must notify the AG when a breach affects 500 or more Colorado residents.
What This Law Covers
COLORADO's breach notification law requires businesses and government agencies that maintain personal information about COLORADO residents to notify affected individuals when that information is subject to unauthorized access or acquisition. "Personal information" typically includes Social Security numbers, driver's license numbers, financial account numbers, and in many states has been expanded to cover medical data, biometric data, online credentials, and tax IDs.
What the Company Must Tell You
A compliant breach notification to COLORADO residents must include:
- ✓A description of the breach — what happened and when
- ✓The types of personal information that were involved
- ✓What the company is doing to investigate and contain the breach
- ✓Steps you can take to protect yourself (e.g., credit freeze, fraud alert)
- ✓Contact information so you can ask questions
Attorney General Notification
When a breach affects more than 500 COLORADO residents, companies must also notify the COLORADO Attorney General.
AG notification required if 500+ CO residents affected
Legal Disclaimer
This reference is for general educational purposes only and does not constitute legal advice. Last reviewed: 2025-01-01. Laws change frequently — always verify against the current official statute and consult a licensed attorney for advice specific to your situation.
Look up breaches affecting COLORADO residents
Search our database for companies that filed breach notifications with the COLORADO attorney general.
Legal Disclaimer
The information on this page is provided for general informational purposes only and does not constitute legal advice. Laws change frequently — always verify the current statute with the official state source or consult a licensed attorney in your jurisdiction before taking any action. This site is not a law firm and does not create an attorney-client relationship.