Data Breach Notice to Residents and State Authorities in Colorado
At a glance
| Covered entity and service provider | Business owner/licensee/maintainer notifies residents; contracted processor promptly notifies and cooperates with owner if misuse occurred or likely (§ 6-1-716(1)(b),(i), (2)(a),(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of unencrypted computerized PI; name with listed IDs, medical/insurance or biometric data, or online credentials or financial access; key compromise counts (§ 6-1-716(1)(g)-(h), (2)(a.4)) |
| Risk screen or notice exception | Good-faith prompt investigation; no notice if misuse has not occurred and is not reasonably likely; good-faith employee acquisition excluded (§ 6-1-716(1)(h), (2)(a)) |
| Individuals who receive notice | Affected Colorado residents whose PI was acquired, unless investigation supports no-misuse finding (§ 6-1-716(2)(a)) |
| Individual notice deadline and clock | Most expedient time, without unreasonable delay; no later than 30 days after breach determination, subject to police/scope/system needs (§ 6-1-716(2)(a),(c)) |
| Regulator threshold and deadline | 500+ CO residents reasonably believed affected: AG within 30 days after breach determination, unless no misuse occurred or likely (§ 6-1-716(2)(f)(I)) |
| Consumer-reporting-agency notice | More than 1,000 CO residents to be notified: all nationwide agencies, expeditiously without unreasonable delay; anticipated resident date and approximate count (§ 6-1-716(2)(d)) |
| Individual delivery and content | Mail, phone, or qualifying electronic notice; incident date/range, acquired PI, entity and credit-agency/FTC contacts, fraud-alert/freezes statement (§ 6-1-716(1)(f), (2)(a.2)) |
| Substitute notice conditions and channels | Cost over $250,000, class over 250,000 CO residents, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 6-1-716(1)(f)(IV)) |
| Delays and alternate compliance | Police impediment delay; notice within 30 days after clearance; own-policy/regulator procedures may suffice but AG report still required (§ 6-1-716(2)(c), (3)) |
Requirements one by one
Trigger, scope, and risk investigation
Colo. Rev. Stat. § 6-1-716(1)(g)-(h) covers unauthorized acquisition of unencrypted computerized personal information. Covered combinations include a resident's name with specified identity, medical, insurance, or biometric data; online-account credentials or financial-account access data also qualify. Subsection (2)(a.4) requires disclosure of secured information if the process or key to decipher it was also acquired or reasonably believed acquired. Good-faith employee acquisition for business purposes is excluded if there is no unrelated use or further unauthorized disclosure.
Under § 6-1-716(2)(a), a covered entity that becomes aware a breach may have occurred must promptly investigate misuse in good faith. It notifies affected Colorado residents unless it finds misuse has not occurred and is not reasonably likely. A contracted data processor gives the covered entity notice and relevant information in the most expedient time possible, without unreasonable delay following discovery, when misuse has occurred or is likely under subsection (2)(b).
Three distinct notification routes
Resident notice must be sent in the most expedient time possible and without unreasonable delay, no later than 30 days after the determination that a breach occurred, allowing the statute's law-enforcement, scope, and system-restoration needs. See § 6-1-716(2)(a).
If a breach is reasonably believed to affect 500 or more Colorado residents, the covered entity also notifies the Colorado Attorney General on the same determination-based 30-day outer limit, unless its investigation finds misuse has not occurred and is not likely. See § 6-1-716(2)(f)(I).
When the entity must notify more than 1,000 Colorado residents, § 6-1-716(2)(d) adds notice to all nationwide consumer reporting agencies as expeditiously as possible and without unreasonable delay. This notice gives the expected resident-notice date and approximate number of residents; financial institutions subject to the cited federal act are exempt from this subsection.
Delivery and contents
Section 6-1-716(1)(f) allows written mail, telephone, or qualifying electronic notice. Subsection (2)(a.2) calls for the breach date or range, acquired data categories, covered-entity contact, consumer-reporting-agency and FTC contacts, and a statement about fraud alerts and security freezes.
If notice will cost over $250,000, the affected class exceeds 250,000 Colorado residents, or contact information is insufficient, subsection (1)(f)(IV) permits substitute notice consisting of email where available, a conspicuous website post if the entity has a site, and major statewide media.
What trips people up
Police delay has its own 30-day restart. Under § 6-1-716(2)(c), law enforcement must determine notice would impede a criminal investigation and tell the covered entity not to send it. After the agency clears notice, it must go in good faith as expeditiously as possible and without unreasonable delay, no later than 30 days after that clearance notice.
Compromised login credentials need extra direction. Section 6-1-716(2)(a.3) requires protective account instructions when online credentials were or likely will be misused. An entity furnishing the breached email account cannot send the notice to that account; an online notice at a known customary access location is one permitted alternative.
A consistent internal or regulator procedure does not erase the AG step. Section 6-1-716(3) recognizes qualifying procedures but expressly preserves the Attorney General report under subsection (2)(f). Where applicable regulator law has a shorter individual-notice timeframe, the shorter time controls.
Common questions
Does every affected person receive notice even when misuse is unlikely?
No. Section 6-1-716(2)(a) requires a prompt good-faith investigation and permits a no-notice result when misuse has not occurred and is not reasonably likely.
Is the credit-agency threshold the same as the Attorney General's?
No. Section 6-1-716(2)(f) sets 500 or more Colorado residents for the Attorney General; subsection (2)(d) uses more than 1,000 residents to be notified for nationwide consumer reporting agencies.
Statutes and sources
- Colo. Rev. Stat. § 6-1-716 — current official 2026 Title 6, including the August 12, 2026 amendment.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Colorado law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Colorado law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace