What is the data breach notification deadline in Colorado?

Colorado requires notice to affected individuals 30 calendar days from discovery (Colo. Rev. Stat. §6-1-716).

Do you have to notify the Colorado Attorney General of a data breach?

Yes. Colorado Attorney General must be notified.

← All jurisdictions

CO · data breach notification

Colorado

high

Colo. Rev. Stat. §6-1-716

Individual deadline

30 days

Trigger standard

Any breach

AG / regulator

Required

Notice to individuals	30 calendar days from discovery
Risk-of-harm standard	None, notice required on any qualifying breach of covered personal information.
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	Colorado Attorney General, required at 500+ residents; within 30 days Online form / email databreach@coag.gov
Credit reporting agencies	Notify CRAs at 1,000+ residents.
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	No, enforcement by the state.
Penalties	AG enforcement; injunctive relief and civil penalties

Rule last verified July 10, 2026 · confidence high. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Colorado breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →