Data Protection Impact Assessment (DPIA) (CO) - Colorado
Colorado Data Protection Impact Assessment
| Record field | Entry |
|---|---|
| Controller and project or feature | [________________________________] |
| Assessment ID and version | [________________________________] |
| Owner and planned start date | [________________________________] |
| Processing period and locations | [________________________________] |
| Prepared by and date | [________________________________] |
| Approval authority and record custodian | [________________________________] |
1. Applicability and Assessment Route
The general CPA scope, a biometric-only route, and the separate minor online-service scope have different reach under C.R.S. § 6-1-1304(1). Analyze each on the facts. An internal assessment may still be used when a statutory route does not apply.
| Scope question | Facts, current source, and conclusion |
|---|---|
| Colorado business or targeted-services nexus | [________________________________] |
| Controller role and consumer/household context | [________________________________] |
| 100,000-consumer or sale-plus-25,000-consumer route under § 1304(1)(a)(I) | [________________________________] |
| Any-amount biometric identifier/data route under § 1304(1)(a)(II); if this is the sole route, identify the covered biometric data and activity | [________________________________] |
| Separate §§ 1305.5, 1308.5, and 1309.5–1313 minor-protection scope under § 1304(1)(b) | [________________________________] |
| Applicable precise data/activity exemption under § 1304(2), if any | [________________________________] |
| Other law, sector rule, or contract requiring an assessment | [________________________________] |
Selected route: ☐ § 1309 heightened consumer risk ☐ § 1309.5 heightened minor risk ☐ Both ☐ Internal only ☐ Further legal review.
Route decision, reviewer, and date: [________________________________]
2. Trigger and Timing
For a covered § 1309 activity, assess each processing activity presenting heightened risk before it begins. Section 1309(2) includes sale and sensitive-data processing, and targeted advertising or profiling when the stated reasonably foreseeable harms are present. That section applies to specified processing involving data acquired on or after July 1, 2023, and activities created or generated after that date; record the actual dates and applicable rule.
For § 1309.5, assess an online service, product, or feature offered on or after October 1, 2025 to a consumer known or willfully disregarded to be a minor when heightened minor harm is present. Record the offering, knowledge facts, risk and creation date; do not treat every minor interaction as the same trigger.
| Potential trigger | Activity, risk facts, source, and timing conclusion |
|---|---|
| Sale of personal data | [________________________________] |
| Sensitive data, including biological and precise geolocation where § 1303(24) applies | [________________________________] |
| Targeted advertising or profiling with a § 1309(2)(a) foreseeable harm | [________________________________] |
| Online feature and reasonably foreseeable heightened harm to known or willfully disregarded minor under § 1309.5 | [________________________________] |
| Comparable set of similar processing operations, if one assessment is proposed | [________________________________] |
Assessment completed before required processing begins: [DATE, EVIDENCE, REVIEWER]
3. Processing Summary and Context
- Specific purpose and activity: [________________________________]
- Relationship to affected consumers and their reasonable expectations: [________________________________]
- Data categories and sources: [________________________________]
- Known child, minor, biometric, biological, precise location, or other sensitive data and exact statutory label: [________________________________]
- Collection, use, analysis, decisions, storage, retention, disclosure, and deletion steps: [________________________________]
- Technology, processors, affiliates, third parties, each access purpose, and compliance review: [________________________________]
- Data-flow and security attachments: [FILE, VERSION, CUSTODIAN]
4. Stakeholders and Benefits
Rule 8.03 calls for relevant internal actors and, where appropriate, external parties. Record contributors and the information they supplied.
| Contributor and role | Input | Date/evidence |
|---|---|---|
| [________________] | [________________] | [________________] |
| [________________] | [________________] | [________________] |
| Beneficiary | Specific direct or indirect benefit and evidence |
|---|---|
| Consumers | [________________________________] |
| Controller | [________________________________] |
| Other stakeholders | [________________________________] |
| Public | [________________________________] |
Alternative using less data or a less intrusive method, and why chosen or rejected: [________________________________]
5. Risks, Safeguards, and Balance
| Source and nature of risk to consumer rights | Affected people and foreseeability | Safeguard, test, and owner | Residual risk |
|---|---|---|---|
| Unauthorized access, adversarial use, or loss of availability | [____] | [____] | [____] |
| Unfair or deceptive treatment, discrimination, or significant-decision error | [____] | [____] | [____] |
| Financial, physical, psychological, reputational, or associational harm | [____] | [____] | [____] |
| Intrusion, loss of control, misleading notice, or ineffective choice | [____] | [____] | [____] |
| Heightened harm to minors from online feature, if § 1309.5 applies | [____] | [____] | [____] |
| Other project-specific harm | [____] | [____] | [____] |
De-identified data, consumer expectations, processing context, and relationship effects considered: [________________________________]
Measures for § 1308 controller duties, security and consumer rights: [________________________________]
Do the specific benefits outweigh the remaining rights risks after safeguards? Explain the evidence and uncertainty: [________________________________]
Decision: ☐ Proceed ☐ Proceed after conditions ☐ Redesign ☐ Do not proceed.
Conditions, owners, dates, and supporting proof: [________________________________]
6. Additional Applicable Analysis
| Special route | Analysis and evidence |
|---|---|
| § 1309(2)(a) qualifying profiling: Rule 9.06 additional assessment | [APPLIES / DOES NOT APPLY; ATTACH ANALYSIS] |
| Rule 6.10 sensitive-data inference exception: deletion and nontransfer process, if used | [APPLIES / DOES NOT APPLY; ATTACH PROCESS] |
| § 1309.5 minor online feature: purpose, data categories, each processing purpose, and foreseeable harm | [APPLIES / DOES NOT APPLY; FACTS] |
| § 1309.5 heightened minor harm found: mitigation or elimination plan | [APPLIES / DOES NOT APPLY; PLAN AND OWNER] |
| Internal or external audit relevant to assessment | [AUDITOR, PEOPLE, PROCESS, RESULTS OR NONE] |
7. Approval, Review, Retention, and AG Request
| Control | Owner, date, and evidence |
|---|---|
| Contributors and reviewer names, positions, dates, and signatures under Rule 8.04 | [________________________________] |
| Processing decision authority and approval | [________________________________] |
| Review schedule based on data and risk under Rule 8.05(B) | [________________________________] |
| If qualifying significant-decision profiling: at least annual fairness/disparate-impact review under Rule 8.05(C) | [________________________________] |
| Material risk change and new-assessment trigger | [________________________________] |
| Electronic transferable record, prior versions, processing-end date, and at least three-year post-end retention under Rule 8.05(E) | [________________________________] |
| If § 1309.5 applies, minor assessment maintenance under § 1309.5(2) | [________________________________] |
| Owner for Attorney General request and 30-day production route under Rule 8.06 | [________________________________] |
Controller decision-maker signature / title / date: [________________________________]
Privacy and security reviewer signatures / dates: [________________________________]
Colorado legal reviewer / date: [________________________________]
Official Sources
- Colorado Revised Statutes, Title 6, current 2026 text: https://olls.info/crs/crs2026-title-06.htm
- Current 4 CCR 904-3, Part 8, effective December 1, 2025: https://www.sos.state.co.us/CCR/GenerateRulePdf.do?ruleVersionId=12259&fileName=4%20CCR%20904-3
About this template
- Last updated
- September 27, 2026
- Citations checked
- September 27, 2026
- Jurisdiction
- Colorado
- Category
- Compliance & Regulatory
Legal authority
- C.R.S. § 6-1-1303(6), (24)
- C.R.S. § 6-1-1304(1)
- C.R.S. § 6-1-1309
- C.R.S. § 6-1-1309.5
- 4 CCR 904-3, Rule 8.04
- 4 CCR 904-3, Rule 8.05
- 4 CCR 904-3, Rule 8.06
Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.
Not legal advice
This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Checked against the law it cites
A reviewer verified this template's legal citations against the official source on September 27, 2026.
C.R.S. § 6-1-1303 (checked September 27, 2026): "Personal data from a known child; (d) Biological data; or (e) Precise geolocation data."
C.R.S. § 6-1-1304 (checked September 27, 2026): "Controls or processes any amount of biometric identifiers or biometric data regardless of the amount of biometric identifiers or biometric data controlled or processed annually"
C.R.S. § 6-1-1309 (checked September 27, 2026): "A controller shall not conduct processing that presents a heightened risk of harm to a consumer without conducting and documenting a data protection assessment of each of its processing activities that involve personal data acquired on or after July 1, 2023, that present a heightened risk of harm to a consumer."
C.R.S. § 6-1-1309.5 (checked September 27, 2026): "A controller that, on or after October 1, 2025, offers any online service, product, or feature to a consumer whom such controller actually knows or willfully disregards is a minor shall conduct a data protection assessment for the online service, product, or feature if there is a heightened risk of harm to minors."
Draft your Data Protection Impact Assessment (DPIA) (CO) in the editor
Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.