Colorado Data Breach Notification Law

The Colorado data breach notification law's 30-day deadline

Day zero is the date the business determines a breach happened, and day 30 is the limit, one of the tightest fixed windows anywhere in the US ¹. Thirty days is a ceiling, not a target: the most expedient time possible and without unreasonable delay still applies.

If a federal rule or another state's law that binds you sets a shorter window, that one wins ¹.

Computerized personal information about Coloradans is what the statute protects ¹. Two standing duties come with it: security procedures reasonable for the data and the size of the business, and a written policy on disposing of records that contain personal information ¹⁴.

Attorney General notice at 500 residents or more

A breach reasonably believed to reach 500 Colorado residents or more goes to the Attorney General within 30 days of the determination ¹². The wording is "500 or more", so a count of exactly 500 qualifies, despite charts that say "more than 500".

If the investigation shows misuse has not occurred and is not likely, the Attorney General filing falls away with the resident letters ¹.

Above 1,000 Colorado residents, the bureaus must be told, except by businesses subject to the Gramm-Leach-Bliley Act ¹. A non-bank lender or tax office in that group has federal duties too; see what the FTC expects in a written security plan.

The no-misuse exception and encryption

A prompt, good faith investigation that concludes misuse has not happened and is not reasonably likely lets a business skip the letters ¹. Colorado does not ask for that conclusion in writing or for a copy at the Attorney General's office. A dated memo is still worth the hour it takes, since it answers the obvious question if residents later learn of the incident.

Encryption protects the data unless whatever decrypts it (key, confidential process or other means) was taken too, or is reasonably believed to have been ¹. A key saved on the same laptop or server offers little cover.

Data Colorado covers that other states miss

Colorado's definition runs well past the usual three identifiers ¹:

• Student, military and passport ID numbers, and employer ID numbers
• Medical and health insurance information
• Biometric data
• Login credentials for an online account

That employer ID entry reaches HR systems: a leaked roster pairing staff names with employer-issued ID numbers can require letters here.

Enforcement and the Colorado Privacy Act

Enforcement is an Attorney General suit in law or equity for appropriate relief or direct economic damages ¹, with no separate penalty figure in the breach statute. The text calls the Attorney General's power non-exclusive yet never mentions private suits, so whether a resident can sue is unsettled.

The Colorado Privacy Act, effective July 1, 2023, is separate and narrower. It covers companies doing business in Colorado or targeting its residents that process data on 100,000 or more Colorado consumers a year, or on 25,000 or more while earning revenue or discounts from selling personal data ³. Few small firms reach either line, and neither line affects the breach law.

Working to Colorado's 30 days

While the intruder is still active, an insured Colorado firm phones its carrier first, files an FBI report through ic3.gov, and keeps the compromised computers untouched for the forensic copy ⁶⁷⁸. If the policy names panel counsel, the carrier call comes before any lawyer is retained; cyber policy conditions explained covers why.

Then:

1. Bring in a specialist response team, or your usual IT shop for something small, to contain it.
2. Sort people by home state. Utah and Kansas residents bring their own laws, and the chart of state breach deadlines covers the rest.
3. Count 30 days from the determination date and put that date on both the resident letters and the Attorney General filing.

Coloradans filed 18,847 complaints with IC3 in 2025 and reported about $355 million in losses ⁵. For ongoing support, see what managed IT costs in Denver and Colorado Springs.

Statute check date: October 13, 2026. This overview stops short of legal advice, so a Colorado lawyer should say how 6-1-716 applies to you and whether another law's shorter clock controls.