Colorado § 6-1-1305.5 Responsibility according to role - processing data of minors

Colorado Statutes

§ 6-1-1305.5 — Responsibility according to role - processing data of minors

Colorado § 6-1-1305.5

Title 06Consumer

Art.Colorado Consumer Protection Act

This text of Colorado § 6-1-1305.5 (Responsibility according to role - processing data of minors) is published on Counsel Stack Legal Research, covering Colorado primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Colo. Rev. Stat. § 6-1-1305.5 (2026).

Text

(1)A processor shall adhere to the instructions of a controller and shall assist the controller to meet the controller's obligations under sections 6-1-1308.5 and 6-1-1309.5, taking into account the nature of the processing and the information available to the processor. The processor shall assist the controller by:

(a)Taking appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligations under section 6-1-1308.5; and

(b)Providing information to enable the controller to conduct and document data protection assessments pursuant to section 6-1-1309.5.

(2)A contract between a controller and a processor must satisfy the requirements in section 6-1-1305 (5).

(3)Nothing in this section shall be construed to relie

Free access — add to your briefcase to read the full text and ask questions with AI

(1)
A processor shall adhere to the instructions of a controller and shall assist the
controller to meet the controller's obligations under sections 6-1-1308.5 and 6-1-1309.5, taking into account the nature of the processing and the information
available to the processor. The processor shall assist the controller by:

(a) Taking appropriate technical and organizational measures, insofar as this
is possible, for the fulfillment of the controller's obligations under section 6-1-1308.5; and

(b) Providing information to enable the controller to conduct and document
data protection assessments pursuant to section 6-1-1309.5.

(2) A contract between a controller and a processor must satisfy the
requirements in section 6-1-1305 (5).

(3) Nothing in this section shall be construed to relieve a controller or
processor from the liabilities imposed on the controller or processor by virtue of the
controller's or processor's role in the processing relationship as described in
sections 6-1-1308.5 and 6-1-1309.5.

(4) Determining whether a person is acting as a controller or processor with
respect to a specific processing of data is a fact-based determination that depends
upon the context in which personal data is to be processed. A person that is not
limited in the person's processing of personal data pursuant to a controller's
instructions, or that fails to adhere to the instructions, is a controller and not a
processor with respect to a specific processing of data. A processor that continues
to adhere to a controller's instructions with respect to a specific processing of
personal data remains a processor. If a processor begins, alone or jointly with
others, determining the purposes and means of the processing of personal data, the
processor is a controller with respect to the processing and may be subject to an
enforcement action under section 6-1-1311.