The Letter About Your Information
C.R.S. 6-1-716 — notice within thirty days of determining a breach, and the attorney general told
A business holding computerized personal information about a Colorado resident that learns a security breach may have occurred promptly investigates in good faith, and notifies affected residents unless it determines the information has not been and is not reasonably likely to be misused.
Who handles this in Colorado: Colorado Department of Law, Stop Fraud Colorado; and legal aid programs and the state offices, listed in the Colorado directory.
Notice is given in the most expedient time possible and without unreasonable delay, and no later than thirty days after determining that a breach occurred. A law enforcement agency may delay it where notice would impede a criminal investigation.
The Colorado attorney general is also notified in the same thirty days where the breach is believed to affect five hundred or more residents, and the consumer reporting agencies where more than one thousand residents are notified.
Sources for this section (1)
- C.R.S. 6-1-716 — Notification of security breach - definitions
Legal information, not legal advice. Verified as of October 2026. Applying it to a particular situation is the work of a licensed Colorado attorney.