Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Colorado |
|---|---|
| Statute citation | Colo. Rev. Stat. § 6-1-716 (Colorado Consumer Protection Act - Notification of Security Breach) (amended 2018) |
| Individual notice timing | 30 days Colorado requires businesses/covered entities to notify affected individuals in the most expedient |
| Attorney general notice | Yes Colorado requires AG notification within 30 days when a breach affects 500 or more Colorado |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Colorado 'security breach' means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a covered entity. Good faith acquisition of personal information by an employee or agent of a covered entity for the covered entity's business purposes is not a security breach if the personal information is not used for a purpose unrelated to the lawful operation of the business or is not subject to f |