← All US breach laws·CO

Colorado data breach notification law

Colorado's data breach notification requirements under Colo. Rev. Stat. §6-1-716. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Colo. Rev. Stat. §6-1-716
Enforcer
Colorado Attorney General
AG notification
Required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
Not later than 30 days after determination that a security breach occurred — the shortest mandatory deadline in any state breach law
Notify the state regulator
Yes — within 30 days if 500 or more Colorado residents are affected; written notice to the Colorado AG
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs without unreasonable delay

When is notification required?

Trigger / harm threshold
Notification not required if, after a good-faith investigation, the misuse of PI has not occurred and is not reasonably likely to occur
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Colorado law

First name/initial + last name with SSN, student ID, military ID, passport number, DL/state ID, medical info, health-insurance ID, biometric data, OR username/email + password/security Q&A granting account access; ALSO account/credit/debit number + access code (without the name) is PI on its own

Penalties and enforcement

Up to $20,000 per violation under the Colorado Consumer Protection Act, capped at $500,000 per related series
Enforced by: Colorado Attorney General. Official regulator page →

Common pitfalls

⚠ 30 days is the strictest deadline in the US — incident response runbooks built around 60-day SOX-style timelines miss this
⚠ Account credentials without a name still count as PI — many SaaS leaks are wrongly scoped out

Frequently asked questions

How long do I have to notify Colorado residents after a data breach?
Not later than 30 days after determination that a security breach occurred — the shortest mandatory deadline in any state breach law
Do I have to notify the Colorado Attorney General?
Yes — within 30 days if 500 or more Colorado residents are affected; written notice to the Colorado AG
Does Colorado require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs without unreasonable delay
Is encrypted data exempt from Colorado's breach notification requirement?
Yes — Colorado has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Colorado residents sue me directly for a data breach?
No — Colorado's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Colorado law?
First name/initial + last name with SSN, student ID, military ID, passport number, DL/state ID, medical info, health-insurance ID, biometric data, OR username/email + password/security Q&A granting account access; ALSO account/credit/debit number + access code (without the name) is PI on its own
What are the penalties for failing to comply with Colorado's breach notification law?
Up to $20,000 per violation under the Colorado Consumer Protection Act, capped at $500,000 per related series

Related state breach laws

Arkansas (AR)
Ark. Code §§4-110-101 to 4-110-108
California (CA)
Cal. Civ. Code §§1798.29
Connecticut (CT)
Conn. Gen. Stat. §36a-701b
Delaware (DE)
6 Del. C. §§12B-101 to 12B-104

Pre-empt the Colorado breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Colorado's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit