ShareAndGoShareAndGo

Data breach notification

Colorado data breach notification law

Colorado's notice rule is C.R.S. § 6-1-716, which requires notice no later than thirty days after a security breach is determined to have occurred.

This page reads the 2024 printout of the Colorado Revised Statutes published by the Office of Legislative Legal Services, marked "Uncertified Printout."

Thirty days, twice

Notice to affected Colorado residents must be made "in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred."

The Colorado Attorney General gets notice on the same terms and the same thirty days when the breach is reasonably believed to have affected five hundred Colorado residents or more. The Attorney General's own guidance repeats the threshold: 500 or more Colorado residents.

Both clocks start from the date of determination, so recording that date clearly matters for both.

Data elements

Personal information is a Colorado resident's first name or first initial and last name with one or more listed elements, when the elements are not encrypted, redacted, or secured by another method that renders the name or element unreadable or unusable.

  • Social Security number
  • Student, military or passport identification number
  • Driver's license number or identification card number
  • Medical information and health insurance identification number
  • Biometric data

A username or email address with a password or security question and answer for an online account also counts, as does an account or card number with any required code or password.

The misuse test

Colorado frames its exception around misuse. The covered entity gives notice unless the investigation determines that misuse of information about a Colorado resident has not occurred and is not reasonably likely to occur.

For encrypted or otherwise secured information, disclosure is still required if the confidential process, encryption key or other means to decipher it was also acquired, or is reasonably believed to have been.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

The watermark comes switched on in every room and can be set per room. Readers confirm their email with a six-digit code, with no account to create. Because each group sees only its own folders and the log records each view, an investigation into one room starts from a defined list of people. The CSV export puts that list, with dates, into a spreadsheet the team already knows how to read.

Colorado questions

How long does a business have in Colorado?
Not later than thirty days after the date of determination that a security breach occurred, and in the most expedient time possible within that.
When must the Attorney General be told?
When the breach is reasonably believed to have affected 500 or more Colorado residents, also within thirty days of the determination.
Is there an exception?
Notice is not owed if the investigation determines misuse has not occurred and is not reasonably likely to occur.
Does this page reflect 2025 or 2026 changes?
No. It reads the 2024 printout, so any amendment enacted in 2025 or 2026 is not reflected.

Review

Checked against the 2024 printout of the Colorado Revised Statutes on November 2, 2026. This is general information, not legal advice.

Next steps

Breach notification laws by state

Other jurisdictions' notice rules.

ShareAndGo vs DataRooms.com

Two data rooms side by side.

ShareAndGo

ShareAndGo home.