Colorado CPA

Colorado Privacy Act - opt-out rights, universal opt-out, sensitive data consent, DPIA.


Short name	CO CPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CO CPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for CO CPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for CO CPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CO-CPA-1308-CARE` Duty of Care: Data Security	Controllers owe a duty of care to take reasonable measures to secure personal data during storage and use, appropriate to the volume, scope and nature of the data; integrity verification of the processing software evidences that duty (Colo. Rev. Stat. § 6-1-1308(5))	Scan
`CO-CPA-1308-MIN` Purpose Specification and Minimisation	Collection must be specified, express and limited to what is reasonably necessary; demonstrating compliance presumes an accounting of the systems and software components through which personal data flows (Colo. Rev. Stat. § 6-1-1308)	Scan
`CO-CPA-1305` Processor Obligations	Processors must adhere to controller instructions under a binding contract, assist with security and breach duties, and flow obligations down to sub-processors; this vendor chain must be identifiable component-by-component (Colo. Rev. Stat. § 6-1-1305)	Scan
`CO-CPA-1309` Data Protection Assessments	Processing that presents a heightened risk of harm (targeted advertising, sale, profiling, sensitive data) requires documented data protection assessments, which depend on knowing the exact versions of the software performing that processing (Colo. Rev. Stat. § 6-1-1309)	Scan
`CO-CPA-1306` Opt-Out and Rights Infrastructure	Consumers hold rights of access, correction, deletion, portability and opt-out, including via a universal opt-out mechanism the controller must honor; executing these rights across systems requires unambiguous identification of the components involved (Colo. Rev. Stat. §§ 6-1-1306, 6-1-1313)	Scan
`CO-CPA-1308-TRANS` Duty of Transparency	Controllers owe a duty of transparency via a reasonably accessible, clear and meaningful privacy notice; supporting system documentation should carry its own identity and creation timestamp so disclosures are auditable (Colo. Rev. Stat. § 6-1-1308(1))	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`6-1-1306`	Consumer Rights: Access, Correction, Deletion & Portability
`6-1-1306(1)(d)`	Universal Opt-Out Signal (GPC) Recognition
`6-1-1308`	Data Protection Assessment
`6-1-1303(22)`	Sensitive Data Consent & Opt-In
`6-1-1309`	Processor Data Processing Agreements
`6-1-1305`	Privacy Notice & Transparency
`6-1-1306(2)`	Consumer Appeal Mechanism
`6-1-1304`	Controller Duties: Minimization, Security & Non-Discrimination
`6-1-1310`	Children's Data Restrictions

Policy templates

Written for CO CPA:

Colorado CPA State Privacy Notice
Colorado CPA Sensitive Data Consent Policy
Colorado CPA Data Protection Assessment Procedure

And 22 from the standard set, adapted to CO CPA.