Colorado AG Provides Clarity On Appropriate Security Practices

The Colorado AG recently provided guidance on data security best practices. Companies doing business in Colorado, especially those subject to the Colorado Privacy Act, should be paying attention to what is required under Colorado law.

On Data Privacy Day (January 28) the Colorado Attorney General (“the AG”), Phillip Weiser, published prepared remarks on data privacy and data security.  The remarks served to highlight the upcoming implementation of the Colorado Privacy Act, noting that by the fall, a formal Notice of Proposed Rulemaking would be posted.  The AG also published guidance on common best practices relating to data security (“Data Security Best Practices”).

Companies following this guidance will be better positioned to limit, or respond to, data breaches. They may also be in a better position to comply with the Colorado Privacy Act, as the law outlines a “Duty of Care” for controllers, which requires them to take reasonable measures to secure personal