A new data protection law took effect in Colorado in early September that requires state employers to implement procedures to protect and eventually destroy employees personally identifiable information. If said information is provided to a third-party service, the covered entity must be sure that reasonable security procedures and practices are upheld. The new law also expands employers notification requirements if employees information is compromised as the result of a data breach. A written policy for the destruction of information must be developed by covered entities.
