Colorado Privacy Act (CPA)

What is the Colorado Privacy Act?

The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal data collection and use and offers significant protection for Colorado residents' personal data.

Who Needs to Comply?

The CPA applies to data controllers that conduct business in Colorado or produce or deliver commercial products and services targeted to Colorado residents and meet either of the following criteria:

• Control or process the personal data of at least 100,000 consumers annually, or
• Derive revenue or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of 25,000 or more consumers.

Data Subject Rights

The CPA empowers data subjects with the following:

• Right to Confirm if a controller is processing their personal data.
• Right to Access their collected and processed personal data.
• Right to Correct any inaccuracies in their personal data.
• Right to Delete their personal data.
• Right to Obtain a portable copy of their personal data for the purpose of data transfer to another controller.
• Right to Opt-Out of personal data processing for targeted advertising, sale of data, or profiling that results in significant effects concerning the consumer.

What are the obligations for Controllers?

The CPA imposes several obligations on controllers, such as privacy notice requirements, conducting data protection assessments, ensuring purpose limitation and data minimization, obtaining consent from data subjects, and implementing adequate security measures.