Colorado Privacy Act, definitions (de-identified data) (Colo. Rev. Stat. 6-1-1303(11) (SB 21-190))
Data only counts as de-identified (and outside the Act) when all three conditions hold: reasonable measures, a public no-re-identification commitment, and a contract binding every recipient.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(11) "DE-IDENTIFIED DATA" MEANS DATA THAT CANNOT REASONABLY BE USED TO INFER INFORMATION ABOUT, OR OTHERWISE BE LINKED TO, AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL, OR A DEVICE LINKED TO SUCH AN INDIVIDUAL, IF THE CONTROLLER THAT POSSESSES THE DATA: (a) TAKES REASONABLE MEASURES TO ENSURE THAT THE DATA CANNOT BE ASSOCIATED WITH AN INDIVIDUAL; (b) PUBLICLY COMMITS TO MAINTAIN AND USE THE DATA ONLY IN A DE-IDENTIFIED FASHION AND NOT ATTEMPT TO RE-IDENTIFY THE DATA; AND (C) CONTRACTUALLY OBLIGATES ANY RECIPIENTS OF THE INFORMATION TO COMPLY WITH THE REQUIREMENTS OF THIS SUBSECTION (11).”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide