Disposal and protection of personal identifying information

Colorado businesses must have a written policy to destroy paper and electronic records containing personal identifying information when no longer needed, rendering it unreadable. Since 2018 they must also maintain reasonable security procedures appropriate to the data and the business, and require service providers to do the same.