DPO SchoolDPO School

Colorado Privacy Act

Colorado privacy law (CPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. They must keep staff bound by confidentiality and use subcontractors only after the controller can object, under a written contract. A binding contract must set out instructions, nature and purpose, data types, duration, deletion or return, compliance information and audits (or an annual independent audit at the processor's expense, with the controller's consent).

Key points

  1. Processor assists with rights requests, security, breach notice and assessments.

    Section: C.R.S. § 6-1-1305(2)

  2. Confidentiality and subcontracting only after an opportunity to object, under a written contract.

    Section: C.R.S. § 6-1-1305(3)

  3. Binding contract with instructions, nature and purpose, data types and duration.

    Section: C.R.S. § 6-1-1305(5)(a) to (c)

  4. Delete or return data at the controller's choice; give compliance information; allow audits or arrange an annual independent audit.

    Section: C.R.S. § 6-1-1305(5)(d)

  5. A processor that sets purposes and means becomes a controller.

    Section: C.R.S. § 6-1-1305(7)

  6. Processors must also help controllers meet the minors' duties.

    Section: C.R.S. § 6-1-1305.5

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Colorado statute

Reference material, not legal advice.