Skip to main content


Will Colorado’s New Data Privacy Law Affect Your Business?

Executive Resource
Find out if your organization will be affected by the Colorado Privacy Act (CPA) that will take effect July 1, 2023.
December 24, 2021

As federal lawmakers struggle to pass a nationwide data privacy law, states are beginning to enact their own legislation. Colorado recently passed a state privacy law that is scheduled to go into effect July 1, 2023. Anyone living in Colorado, conducting business with Colorado residents, or operating a business in Colorado, should have the Colorado Privacy Act (CPA) at the top of mind.

In addition to giving consumers rights and protections over their data, the regulation requires companies to be accountable to their consumers and implement protections over consumer data. The CPA is a comprehensive data privacy law akin to the California Consumer Privacy Act (CCPA) and the Consumer Data Protection Act (CDPA) recently passed in Virginia. The CPA applies to organizations handling the data of 100,000 or more consumers annually or if revenue is derived from the sale or processing of data from 25,000 or more consumers annually.

For organizations, the first step in complying with the new regulation is to designate a new or existing employee as the company’s Data Controller to be responsible for ensuring the safety of collected consumer data and handling data requests from consumers.

Definitions of Key Terms

Some keywords could have a material impact on the interpretation of certain areas of the regulation. These keywords and their definitions, summarized from the CPA, are:

Does the CPA Apply to Your Organization?

In order for the CPA to apply to the organization, certain requirement thresholds must be met. These requirements specify that:

In two of its most important provisions, the CPA 1) gives consumers the right to have their data deleted or erased from company records entirely and receive proof of the deletion and 2) requires that inaccuracies of consumer data be corrected and that the consumer receives proof of the correction.

Colorado consumers also have the right to:

While the provisions and requirements are similar to those in the CCPA and CDPA, these regulations apply specifically to Colorado residents. The CPA doesn’t cover certain categories of data that are already regulated by other laws. Additionally, the CPA also doesn’t allow for any private right of action.

The regulations will go into effect on July 1, 2023.  Organizations doing business with and/or maintaining data of Colorado residents should be taking steps now to update their privacy policies and procedures to include the requirements outlined in the CPA.

How Will the New Law Affect Your Company?

Just like GDPR, CCPA, and CDPA, implementing compliance activities for a new regulation can sometimes be a headache. As you consider your organization’s options for CPA compliance, here are some questions to consider:

Organizations that are proactive in their approach to privacy should find that their resources and business procedures won’t be hindered when consumer requests begin coming in.

For more information about the CPA and how it may apply to your business, contact us. We are here to help.

Authored by Hunter Sundbeck, CDPSE.

© 2021