Skip to content
Network USA

CO · Breach notification statute

Colorado data breach notification law

A summary of the Colorado breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Colo. Rev. Stat. § 6-1-716 (Colorado Consumer Protection Act - Notification of Security Breach) (amended 2018)

Last amended
2018 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

30 days Colorado requires businesses/covered entities to notify affected individuals in the most expedient

Attorney general notice

Yes Colorado requires AG notification within 30 days when a breach affects 500 or more Colorado

What counts as a breach

In Colorado 'security breach' means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a covered entity. Good faith acquisition of personal information by an employee or agent of a covered entity for the covered entity's business purposes is not a security breach if the personal information is not used for a purpose unrelated to the lawful operation of the business or is not subject to f

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Colorado

142 reports to HHS OCR affecting 29,384,025 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Colorado.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Welltok, Inc.Business Associate14,782,887Nov 6, 2023Hacking/IT IncidentArchive (closed)
Colorado Department of Health Care Policy & FinancingHealth Plan4,091,794Aug 11, 2023Hacking/IT IncidentArchive (closed)
DaVita Inc.Healthcare Provider2,689,826Aug 1, 2025Hacking/IT IncidentUnder investigation
Professional Finance Company, Inc.Business Associate1,918,941Jul 1, 2022Hacking/IT IncidentArchive (closed)
Summit Pathology and Summit Pathology Laboratories, Inc.Healthcare Provider1,813,538Oct 18, 2024Hacking/IT IncidentUnder investigation

Frequently asked questions

When must Colorado businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Colorado timing rule as: "30 days Colorado requires businesses/covered entities to notify affected individuals in the most expedient". (Source: PRC 2026 survey extract.)

Does Colorado require notice to the attorney general?

The PRC 2026 extract notes: "Yes Colorado requires AG notification within 30 days when a breach affects 500 or more Colorado". (Source: PRC 2026 survey extract.)

Does the Colorado law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Colorado breach law.

Does the Colorado law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Colorado breach law.

Does the Colorado law cover paper records?

No. The PRC 2026 survey records the Colorado law as covering computerised data only, not paper records.

Is there a private right of action in Colorado?

No. The PRC 2026 survey does not record a private right of action under the Colorado breach law.

Is credit monitoring required in Colorado?

No. The PRC 2026 survey does not record a credit monitoring requirement in Colorado.

How does the Colorado law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Colorado statute, and see our HIPAA vs state breach notification laws guide.

Sources