Home / Solutions / Colorado Privacy Act (CPA)

The Colorado Privacy Act (CPA)

The Colorado Privacy Act (CPA) passed on June 7, 2021, making Colorado the next major state to shape the US Privacy landscape. The CPA increases the protection of consumers’ data and further expands consumer privacy rights for Colorado residents.

Like the Virginia CDPA, the CPA establishes several privacy rights including the right to opt-out, right to access, right to correction, right to deletion, and the right to data portability. The CPA also imposes obligations on data controllers such as transparency, purpose specification, data minimization, avoiding unlawful discrimination, and the use of sensitive data.

The CPA will go into effect on July 1, 2023.

Learn More About CPA

How OneTrust Helps

OneTrust offers a complete suite of technology solutions to help organizations accelerate time to compliance with Colorado’s Privacy Act (CPA). OneTrust enables organizations to operationalize and automate CPA requirements across processing of personal information, data subject rights requests, operator breaches and enforcement, and data protection assessments. 

Get Same-Day Support for CPA Regulatory Updates 

Receive news and guidance updates and assess your program’s maturity

Automate Privacy Operations

Automate the fulfillment of data subject requests

Demonstrate Compliance and Accountability

Automate reporting, dashboarding, audit trails, and other record keeping requirements

Get Same-Day Support for CPA Regulatory Updates 

Access Research and Guidance on the CPA

Access a centralized repository of resources that includes the full CPA text, summaries, guides, and regulatory guidance. Stay up to date with the latest amendments, news, and developments. 

Generate Your Data Protection & Security Readiness Report  

Leverage industry-recognized readiness and planning reports to assess your organization’s gaps and remediation recommendations to minimize risks. Opt-in to share your readiness and benchmark your program against 300+ other organizations. 

Automate Privacy Operations

Automate Intake and Fulfillment of Data Subject Requests

CPA § 1306

Simplify request intake with pre-built web form templates and the drag-and-drop web form builder. Leverage CPA response workflows to help your organization respond to requests appropriately and adhere to the 45-day response timeline.  

Enable Opt-Out Requests & Track Across Your Systems

CPA § 1306(1)(a)

Comply with CPA’s opt-out requirements and leverage website geo-targeting to ensure Colorado residents are seeing the appropriate opt-out controls, such as do not sell, do not profile, and do not process for targeted advertising requests. Track verifiable consumer consent and sync across systems to avoid the unauthorized sale of data.

Centralize & Distribute Privacy Disclosures

CPA § 1308(1)

Adhere to CPA notification requirements and easily update, centralize, and distribute policies, notices, and disclosures across web and mobile properties from a single platform. Update privacy notices to include data subject rights under CPA and direct consumers to a data subject rights intake form.  

Demonstrate Compliance and Accountability

Map Data Flows

CPA § 6-1-1305(5)(b)

Track key attributes when mapping data for CPA compliance, including international data transfers and transfers to third parties. Additionally, utilize bulk importing capabilities to attach CPA data attributes to new and existing data. 

Conduct Data Protection Assessments  

CPA § 6-1-1309

Leverage Data Protection Assessments when doing certain types of data processing. Ensure adherence to the data minimization and purpose specification considerations as outlined under the CPA.

Accelerate time to CPA compliance with OneTrust

Operationalize and automate CPA requirements and accelerate time to compliance with OneTrust technology solutions. 

The Colorado Privacy Act (CPA)