Timing: Must be made in the most expedient time possible and without unreasonable delay, but not later than 30 days after determining a breach occurred, consistent with measures necessary to determine the scope of the breach and to restore reasonable integrity to the system.Ĭontent: Notice must include, at a minimum– Notification is not required if, after a good faith and prompt investigation, the subject entity determines that misuse of information about a Colorado resident has not and is not reasonably likely to occur. Statute does not apply to personal information that is encrypted, redacted, or secured by any other method that renders the name or element unreadable or unusable. The unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a subject entity, excluding good faith acquisitions.
Breach and clear deadline freezes at intro password#
Does not apply to third-party service providers. Most expedient time possible, without unreasonable delay, but not later than 30 days of determination that breach has occurred.Īpplies to individuals, corporations, businesses and any other commercial entity that maintains, owns, or licenses personal information in the course of business.