Law / United States / 
Colorado
C.R.S. 6-1-716, Notification of Security Breach
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- If you experience unauthorized acquisition of unencrypted computerized personal information of Colorado residents, notify affected residents without unreasonable delay and within 30 days of determining a breach occurred.
- Notify the Colorado Attorney General of a security breach affecting 500 or more Colorado residents without unreasonable delay and not later than 30 days after the date of determination that a security breach occurred; also notify nationwide consumer reporting agencies if more than 1,000 residents are affected.
These lines are LexLint's reading of the law's text. Also read by: Colorado Department of Law, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://coag.gov/resources/data-protection-laws/
- Guidance body
- Colorado Department of Law, Office of the Attorney General
- Open questions
- When is the "date of determination that a security breach has occurred" reached under C.R.S. 6-1-716, so that the 30-day notice period starts, for an entity that is still investigating the likelihood that personal information has been or will be misused?
What it makes you log
Logging duty
The section requires a covered entity to investigate a possible breach, notify affected Colorado residents within 30 days of the determination, notify the Attorney General within 30 days where 500 or more residents are affected, and notify consumer reporting agencies where more than 1,000 are. It requires notice only and does not require the entity to document or keep a record of the breach or its investigation. Subsection (3)(a) mentions an entity's own notification procedures as an information security policy, which the section does not require. Colorado Revised Statutes 6-1-713 and 6-1-713.5, which the section's enforcement clause names, are outside the row. The statute's text is taken from the official C.R.S. 2024 Title 6; the row's own cited page is the Attorney General's guidance page.
- Kind
- None
- As of
What this law does
Requires a person or commercial entity that maintains computerized personal identifying information of Colorado residents to notify affected residents of a security breach in the most expedient time possible, without unreasonable delay, and within 30 days of determining a breach occurred, subject to a delay while a law-enforcement investigation is pending.
A breach affecting 500 or more residents must also be reported to the Colorado Attorney General; one affecting more than 1,000 residents must also be reported to nationwide consumer reporting agencies. A separate statute, C.R.S. 24-73-103, covers a governmental entity's own breach-notification duty. HB 24-1130 cross-references this section for the biometric-specific breach-response protocol a controller's written policy must include.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .