State: Colorado
Does the Colorado law apply to businesses outside Colorado? yes, it applies to any business that does business with a Colodoan
What does Colorado’s new data breach law require?
- Notification to affected consumers within 30 days of discovery of the breach
- Provide the consumer with the date of the breach
- Provide the consumer a description of what information was accessed
3 Ways the Colorado legislation differed from most states:
- A delay in notification can only occur if an investigation by the entity that was breached determines that the misuse of information about a resident has not occurred and is not reasonably likely to occur.
- Colorado requires 30 days notice and does NOT use the phrase “”without unreasonable delay”
- Colorado requires 30 days notice and does NOT use the phrase “in the most expedient time possible”
Stateline | When Hackers Strike, Companies in Colorado Now Have 30 Days to Notify Customers