Co-author, Law360, June 14, 2018
In late May, Colorado enacted a sweeping new data security law that will impact businesses throughout the country. The new law — HB 18-1128, or the data security law — imposes several requirements on companies that maintain the personal information of Colorado residents. Specifically, the data security law establishes new obligations regarding: (1) data breach response; (2) the protection of certain types of personal information; and (3) the disposal of certain types of personal information, although the third obligation applies only to companies with a physical presence in the state. On their face, these new requirements apply to most companies that collect personal information online and establish Colorado as one of the most aggressive states in the nation with regard to data security.