Colorado Privacy Act (CPA)

1. Right to opt-out: (I) A consumer has the right to opt-out of the processing of personal data concerning the consumer for purposes of:
   • Targeted Advertising;
   • The Sale of Personal Data; Or
   • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.
2. Right of access: A consumer has the right to confirm whether a Controller is processing personal data and to access such data.
3. Right to correction: A consumer has the right to correct the inaccuracies in the consumer’s personal data.
4. Right to deletion: A consumer has the right to delete personal data.
5. Right to data portability: A consumer has the right to access personal data in a readily usable and portable format. A consumer can exercise this right maximum of 2 times in a calendar year.

Controllers have 45 days to respond to an authenticated consumer request, which can be extended by 45 additional days where it is reasonably necessary to do so.

1. Duty of transparency: A Controller must provide the data subject with a clear and reasonably accessible privacy notice which includes all the required information and declarations.
2. Duty of purpose specification: A Controller must specify the express purpose for the collection and processing of data.
3. Duty of data minimization: A Controller should limit the collection of personal data to what is adequate and relevant for the specified purpose.
4. Duty to avoid secondary use: The Controller shall process personal data only for the purposes that are reasonably necessary or compatible with the specified purposes or obtain the consumer’s consent for further processing.
5. Duty of care: A Controller shall take reasonable measures to secure personal data during both storage and use from an unauthorized acquisition.
6. Duty to avoid unlawful discrimination: A Controller shall not process personal data in violation of State or Federal laws that prohibit unlawful discrimination against consumers.
7. Duty regarding sensitive data: Controller shall obtain the consent of the consumer before processing their sensitive data or for data concerning a known child, the consent of child’s parent or lawful guardian.

Controllers must undertake a data protection assessment for each processing activity involving a heightened risk of harm to consumers, including:

1. Targeted advertising where profiling presents a risk of
   • Unfair or deceptive treatment of, or unlawful or disparate impact on consumers.
   • Financial or physical injury to consumers.
   • An intrusion upon a consumer’s solitude or seclusion, or the private affairs or concerns of the consumer if such an intrusion would be offensive to a reasonable person.
   • Other substantial injury to consumers.
2. Selling personal data.
3. Processing sensitive data.

Controllers must present these data protection assessments to the CO Attorney General upon request.

Mandatly’s CPA compliance solution goes above and beyond automation and includes comprehensive privacy risk management features that enable you to make effective business decisions and eliminate privacy risks.