Colorado Data Breach Notification Law: What Your Business Must Do and When

• The 30-day clock
• Does it apply to you?
• What data counts
• Who must be told
• What the notice says
• Special situations
• First 30 days
• FAQ

Weeks Can Disappear Between “Something Is Wrong” and the First Notice

In the summer of 2023, the Colorado Department of Higher Education (CDHE) was hit by ransomware. The Denver Gazette's review of department emails shows staff noticing suspicious activity on June 14 and identifying file encryption tied to ransomware on June 19. The department's own public FAQ dates its awareness of the incident to June 19. According to the Gazette, officials at several universities learned of the attack on July 28, when a department manager mentioned it in a meeting. The public notice, and the report to the Attorney General's office through the state's online portal, came on August 4.

Two caveats before drawing anything from that. State agencies are covered by a parallel statute for governmental entities, C.R.S. § 24-73-103, rather than the one that governs private businesses, as the Attorney General's FAQ explains. And the Gazette reported that the Attorney General's office declined to comment on the timing, so nothing here is a finding that anyone broke the law.

What the timeline does show is how quickly calendar days pass while a team is containing an incident, rebuilding systems, and working out what was taken. For a private business in Colorado, the statute counts 30 days from a specific legal trigger (§ 6-1-716(2)(a)). It is worth understanding that trigger before an incident rather than during one.

When the 30 Days Actually Start

The statute counts the 30 days from the date of determination that a security breach occurred, and defines that determination as the point at which there is sufficient evidence to conclude that a security breach has taken place (§ 6-1-716(1)(c)). Separately, once you become aware that a breach may have occurred, the statute requires a prompt, good-faith investigation into the likelihood that personal information has been or will be misused (§ 6-1-716(2)(a)).

The statute does not say how to apply “sufficient evidence” to any particular incident, so applying that definition to your situation is a question for your attorney.

1. Something looks wrong. A suspicious login, a ransom note, a lost laptop.
2. Prompt, good-faith investigation. Required once you are aware a breach may have occurred (§ 6-1-716(2)(a)).
3. Determination. Sufficient evidence that a breach took place. The 30-day count begins here.
4. Notice goes out. Residents, plus the Attorney General if the breach is reasonably believed to have affected 500 or more Colorado residents, no later than day 30 (§ 6-1-716(2)(a) and (2)(f)(I)).

The statute sets the 30-day outer limit “consistent with” two things: the legitimate needs of law enforcement, and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the computerized data system (§ 6-1-716(2)(a)). The Attorney General's FAQ says notice may be delayed consistent with those same two things. Neither source gives a number of extra days for scoping. The statute does spell out one specific delay: if a law enforcement agency determines that notice would impede a criminal investigation and notifies the covered entity not to send it, notice must be made in good faith, in the most expedient time possible, and not later than 30 days after the agency determines that notification will no longer impede the investigation and says it is appropriate to send it (§ 6-1-716(2)(c)). How much room the scoping language gives in a real incident is a question for your attorney.

Does Colorado's Law Apply to Your Business?

The statute applies to a “covered entity,” defined as a person that maintains, owns, or licenses personal information in the course of its business, vocation, or occupation (§ 6-1-716(1)(b)). The definition turns on whose data you hold. The Attorney General's FAQ describes the affected group as anyone who maintains, owns, or licenses personal information of Colorado residents. If you hold personal information about Colorado residents, the Attorney General's description suggests the law may apply to you, so confirm the details with an attorney.

The statute's covered entity definition excludes a person acting as a third-party service provider, which it defines as an entity contracted to maintain, store, or process personal information on behalf of a covered entity (§ 6-1-716(1)(b) and (1)(i)). Service providers have their own notice duty, covered in the special situations section below.

What Counts as a Security Breach

Under the statute, a security breach is the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a covered entity. An employee's good-faith acquisition of personal information for the business's legitimate purposes is not a breach, as long as the information is not used for an unrelated purpose or further disclosed without authorization (§ 6-1-716(1)(h)).

The Attorney General's FAQ gives concrete examples of what can qualify: an employee clicking a link or opening an attachment that delivers malware, an employee handing a password to an unauthorized person, a ransomware attack, and a lost or stolen mobile or storage device holding personal information (Colorado AG data protection FAQ). For the practical response steps, see our What Happens When a Business Gets Hacked (Step-by-Step) guide.

What Counts as “Personal Information”

Colorado's definition goes well beyond Social Security numbers. It has three parts, summarized below from § 6-1-716(1)(g) and the Attorney General's FAQ.

“Medical information” here means any information about a consumer's medical or mental health treatment or diagnosis by a health-care professional (§ 6-1-716(1)(e)). The credentials category stands on its own: a username or email address combined with a password or security questions and answers is personal information under the statute even when no Social Security number or other data element is involved (§ 6-1-716(1)(g)(I)(B)).

Who You Have to Notify, and When

The Attorney General takes breach reports through an online Data Breach Reporting Form. Per the Attorney General's guidance, the form cannot be saved partway, so it has to be completed in one sitting. A submitted form and any example notices you upload may be subject to disclosure under the Colorado Open Records Act, and the Attorney General says the form fields that may be subject to disclosure are those containing contact information, the type of affected personal information, and the dates the breach began and ended.

What the Notice to Residents Must Say

Colorado specifies what the notice must contain. It must include, at a minimum, all of the following (§ 6-1-716(2)(a.2)):

• The date, estimated date, or estimated date range of the breach
• A description of the personal information that was acquired or is reasonably believed to have been acquired
• Information the resident can use to contact you with questions about the breach
• The toll-free numbers, addresses, and websites for the consumer reporting agencies
• The toll-free number, address, and website for the Federal Trade Commission
• A statement that the resident can obtain information from the FTC and the credit reporting agencies about fraud alerts and security freezes

How the notice can be delivered

The statute allows written notice to the postal address in your records, telephone notice, or electronic notice. Electronic notice is available if email is a primary way you communicate with that resident, or if the notice is consistent with the federal E-SIGN Act (§ 6-1-716(1)(f)).

Substitute notice is available only in narrow cases: the cost of notice would exceed $250,000, more than 250,000 Colorado residents must be notified, or you lack sufficient contact information. It has three required parts, all together: email notice if you have addresses, conspicuous posting on your website if you have one, and notification to major statewide media (§ 6-1-716(1)(f)(IV)).

Special Situations

When passwords were exposed

If your investigation determines that account credentials (a username or email with a password or security answers) were misused or are reasonably likely to be misused, the notice must also tell people to promptly change their password and security question or answer, or take other steps to protect that account and any other online account that uses the same credentials. That instruction has the same 30-day outer limit. The statute adds a specific rule: if the credentials involved are for an email account that you furnished, you cannot satisfy the law by sending the notice to that same email address. The statute lets you use the other delivery methods, or a clear and conspicuous notice delivered online when the person is connected from an IP address or online location you know they customarily use (§ 6-1-716(2)(a.3)).

When a vendor holds your data

If you use a third-party service provider to maintain computerized data that includes personal information, that provider must notify you and cooperate if a breach compromises the data. It must tell you in the most expedient time possible and without unreasonable delay after discovery when misuse of a Colorado resident's information occurred or is likely to occur. Cooperation includes sharing relevant information, though it does not require disclosing confidential business information or trade secrets (§ 6-1-716(2)(b)). The statute places the duty to notify residents on the covered entity rather than the service provider (§ 6-1-716(1)(b) and (2)(a)).

When you are regulated by HIPAA, GLBA, or another regime

The statute says a covered entity that is regulated by state or federal law and maintains security breach procedures under its regulator's laws, rules, regulations, or guidance is in compliance with the section. Two things still apply. You must notify the Attorney General when the breach is reasonably believed to affect 500 or more Colorado residents, and when the regulator's deadline for notifying individuals differs from Colorado's, the shorter timeframe controls (§ 6-1-716(3)(b)). The Attorney General's FAQ uses HIPAA as its example: because HIPAA in some circumstances permits notice within up to 60 days, Colorado's 30-day period is the one to follow.

A business that maintains its own notification procedures as part of an information security policy, with timing consistent with the statute, is treated as compliant if it notifies residents under those procedures. The Attorney General notice requirement still applies there too (§ 6-1-716(3)(a)).

When residents of other states are affected

Colorado is one of many states with its own rules. The Attorney General advises that if sensitive information relating to residents of other states was compromised, you should review the applicable state law for notice requirements (Colorado AG FAQ). The FTC's business guide notes that all states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted breach notification legislation (FTC Data Breach Response guide). For Colorado-specific FBI cybercrime data, see our Colorado Cybercrime Statistics 2026: What the FBI's Data Shows Local Businesses article.

Notice costs and waivers

A covered entity required to notify Colorado residents cannot pass the cost of the notice on to them, and any waiver of these notification rights or responsibilities is void as against public policy (§ 6-1-716(2)(a.5) and (2)(e)).

Duties That Apply Before a Breach Happens

Notification is the third of three pieces in Colorado's data security framework, according to the Attorney General's FAQ. The other two apply every day, not only after an incident:

• Written disposal policy. The statute requires a covered entity to adopt a written policy for destroying or disposing of paper and electronic documents containing personal identifying information when they are no longer needed, unless other state or federal law requires otherwise (C.R.S. § 6-1-713; see also the Attorney General's FAQ).
• Reasonable security. A covered entity must implement and maintain reasonable security procedures and practices, appropriate to the sensitivity of the information and the size and operations of the business, to protect personal identifying information from unauthorized access, use, modification, disclosure, or destruction (C.R.S. § 6-1-713.5).
• Vendor security. Unless the covered entity provides its own protection, it must require any third-party service provider to maintain reasonable security procedures suited to the type of information shared and reasonably designed to protect it (C.R.S. § 6-1-713.5, which also describes when this requirement does not apply).

Both sections treat a covered entity regulated by state or federal law as compliant if it follows the procedures its regulator sets (§ 6-1-713, § 6-1-713.5), and the Attorney General's FAQ says the same. If you carry cyber insurance, our What Your Cyber Insurance Policy Actually Requires (And Why So Many Claims Get Denied) article is related reading.

What Happens If You Do Not Comply

The Attorney General may bring an action in law or equity to address violations of the breach notification section and the two data security sections above, and to obtain other relief appropriate to ensure compliance or to recover direct economic damages resulting from a violation, or both. The statute also says its provisions are not exclusive and do not relieve a covered entity from complying with other applicable law (§ 6-1-716(4)).

We are not quoting penalty dollar figures here. Section 6-1-716(4) does not set one, and how other parts of the Colorado Consumer Protection Act could apply to a particular situation is a question for your attorney.

Your First 30 Days: A Checklist

The badges show where each step comes from. A Statute step is something Colorado law requires. A Recommended step comes from the FTC's business guide or is a practical suggestion from us, and is not a legal requirement.

• Recommended Bring in legal counsel and consider an independent forensic team early. The FTC's guide suggests consulting counsel with privacy and data security experience and hiring forensic investigators to determine the source and scope of the breach (FTC guide).
• Recommended Preserve evidence and document your investigation. The FTC advises not destroying forensic evidence and documenting your investigation (FTC guide).
• Statute Investigate promptly and in good faith. Once you are aware a breach may have occurred, determine the likelihood that personal information has been or will be misused (§ 6-1-716(2)(a)).
• Recommended Inventory what was taken. Compare the data against the personal information categories above, check whether it was encrypted and whether the means to decipher it was also taken, and count the Colorado residents affected so you know which thresholds apply.
• Statute Send resident notices with all six required elements, no later than 30 days after the determination (§ 6-1-716(2)(a) and (2)(a.2)).
• Statute File with the Attorney General if 500 or more Colorado residents are affected, using the online reporting form, inside the same 30 days (§ 6-1-716(2)(f)(I)).
• Statute Notify the nationwide credit bureaus if you must notify more than 1,000 residents, giving the anticipated notice date and approximate headcount (§ 6-1-716(2)(d)).
• Recommended Call law enforcement. The FTC recommends contacting local police right away, and the local FBI or Secret Service office if local police are not familiar with investigating information compromises. The FTC also advises consulting your law enforcement contact about the timing of notification so it does not impede the investigation (FTC guide). The statute's law enforcement delay is described above.
• Recommended Notify affected businesses and check your vendors. If you hold data for other businesses, the FTC advises notifying them, and if a service provider was involved, reviewing what information it can access (FTC guide).
• Recommended Check your cyber insurance policy for any notice or claim requirements it has. This one is our suggestion, not something Colorado law or the FTC guide requires.
• Recommended Consider offering credit monitoring or identity protection. The FTC suggests at least a year of free credit monitoring when Social Security numbers or financial information were exposed (FTC guide), and points people to IdentityTheft.gov for recovery steps.

Frequently Asked Questions

How long do I have to notify people after a data breach in Colorado?

Notice must go out in the most expedient time possible and without unreasonable delay, and not later than 30 days after the date of determination that a security breach occurred. The statute also provides for a delay when a law enforcement agency determines notice would impede a criminal investigation and asks the covered entity not to send it, and it ties timing to the measures needed to determine the breach's scope. How those provisions apply to a specific incident is a question for an attorney (§ 6-1-716(2)(a) and (2)(c)).

Do I have to report a data breach to the Colorado Attorney General?

Yes, if the breach is reasonably believed to have affected 500 or more Colorado residents, unless the investigation determines that misuse of information about a Colorado resident has not occurred and is not likely to occur. The deadline is the same 30 days, and the Attorney General accepts reports through its online reporting form (§ 6-1-716(2)(f)(I)).

Does Colorado's breach law apply if my business is outside Colorado?

The law is built around personal information of Colorado residents. The Attorney General's FAQ describes the affected group as anyone who maintains, owns, or licenses that information in the course of business. If you hold data on Colorado residents, confirm with an attorney how the law applies to you, and review the laws of any other state where affected people live.

Is a ransomware attack a reportable data breach in Colorado?

The Attorney General lists ransomware as an example of a security breach. Whether you must notify turns on your investigation: if personal information of Colorado residents was acquired, notice is required unless the investigation determines that misuse has not occurred and is not reasonably likely to occur (§ 6-1-716(2)(a)).

What if the stolen data was encrypted?

The breach definition covers unencrypted data, but a breach of encrypted information must still be disclosed if the key or other means to decipher it was also acquired or is reasonably believed to have been (§ 6-1-716(2)(a.4)).

Can I charge customers for the cost of breach notification?

No. A covered entity required to notify Colorado residents is prohibited from charging them the cost of providing that notice (§ 6-1-716(2)(a.5)).

I follow HIPAA. Do I still have to meet Colorado's 30-day deadline?

Following your regulator's breach procedures generally counts as compliance, but you must still notify the Attorney General at 500 or more Colorado residents, and the shorter notice deadline controls when the two differ. The Attorney General's FAQ specifically notes that HIPAA can allow up to 60 days in some circumstances, in which case Colorado's 30 days applies (§ 6-1-716(3)(b)).

Read the Law Yourself