Colorado Privacy Act Sample Clauses
Colorado Privacy Act. This section documents the safeguard standards imposed to protect Client information subject to the Colorado Privacy Act (6-1-1301) (“CPA”). To the extent Provider’s services constitute processing of personal information governed by CPA, these provisions shall apply. Provider shall adhere to the instructions of the controller and assist the controller to meet its obligations under the CPA. Taking into account the nature of processing and the information available to Provider, Provider shall assist the controller by:
a. taking appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligation to respond to consumer requests to exercise their rights pursuant to section 6-1-1306;
b. helping to meet the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of the system pursuant to section 6-1-716; and
c. providing information to the controller necessary to enable the controller to conduct and document any data protection assessments required by section 6-1-1309. Notwithstanding the instructions of the controller, Provider shall:
a. ensure that each person processing the personal data is subject to a duty of confidentiality with respect to the data; and
b. engage a subcontractor only after providing the controller with an opportunity to object and pursuant to a written contract that requires the subcontractor to meet the obligations of the processor with respect to the personal data. Taking into account the context of processing, Provider shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk and establish a clear allocation of the responsibilities between Provider and the controller to implement the measures. Processing by Provider must be governed by a contract between the controller and Provider that is binding on both parties and that sets out:
a. the processing instructions to which the processor is bound, including the nature and purpose of the processing;
b. the type of personal data subject to the processing, and the duration of the processing; and
c. the following requirements:
(i) at the choice of the controller, Provider shall delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law;
(a) Provider shall make available to the ...