| Scope and covered activity | CPRA: define the exact products, services, processing, claims, entities, assets, or activities that bring this side into scope; record out-of-scope facts separately. | Colorado Privacy Act: test its own scope boundary, exclusions, and covered activity; do not copy the CPRA conclusion without a separate source-linked finding. | Write two scope findings first: where CPRA applies, where Colorado Privacy Act applies, and which facts are outside one side even if evidence can be reused. |
|---|
| Who must act | CPRA: identify the business, service provider, contractor, or third party that actually holds the duty, and separate that actor from the entity that merely supplies data or tooling. | Colorado Privacy Act: identify the controller or processor that holds the comparable duty and note whether the duty follows the primary entity, a processor, or a downstream third party. | Name each role separately because one entity can hold different obligations in different workflows. |
|---|
| Trigger or threshold | CPRA: state the fact that starts the obligation, such as a sale or sharing decision, a sensitive-personal-information use, an ADMT use, a request timeline, or a contract change. | Colorado Privacy Act: identify the specific trigger for the comparator law so the team does not assume the same process starts both obligations at the same moment. | Start with the trigger so teams do not apply the wrong regime to the wrong facts. |
|---|
| Core obligations | CPRA: provide the California-specific notice and rights stack, including opt-out of sale/sharing, limit sensitive personal information, request-to-know/delete/correct handling, opt-out preference signals, ADMT notices, and the related response timelines. | Colorado Privacy Act: compare whether the other law uses the same notice, opt-out, and response pattern or a narrower rights package, then document the actual operational gap. | Translate obligations into tickets, notices, records, controls, or contract terms. |
|---|
| Evidence and records | CPRA: keep the evidence that proves this side of the decision, including cited text, registers, policies, test records, contracts, notices, reports, approvals, or audit artifacts. | Colorado Privacy Act: keep comparator evidence in a distinct record set and link only the artifacts that genuinely satisfy both source-linked requirements. | Keep source links, factual analysis, owner approval, and implementation evidence together. |
|---|
| Timing and cadence | CPRA: capture the application date, commencement date, transition period, reporting clock, review cadence, remediation window, or certification renewal that controls this side. | Colorado Privacy Act: track the comparator schedule separately so a later deadline, recurring audit, or incident timer is not hidden by the other workstream. | Use current source dates; do not reuse old project plans after amendments or guidance updates. |
|---|
| Enforcement or assurance route | CPRA: identify the competent authority, regulator, assessor, customer audit, certification body, contractual remedy, penalty, or supervisory process tied to this side. | Colorado Privacy Act: identify the comparator enforcement or assurance route and record where supervision, penalties, market access, certification, or contract leverage differs. | Escalate when enforcement routes differ because a regulator, market-surveillance authority, certification body, customer, or contract counterparty may require different proof. |
|---|
| Overlap and reuse | CPRA: reuse controls only where the source-linked duty, evidence standard, owner, and timing align with the comparator; otherwise keep a bridge note. | Colorado Privacy Act can reuse evidence from the other side only when the same fact pattern, system boundary, control, owner, and source-linked requirement are genuinely aligned. | Document overlap explicitly instead of merging both tests into one vague compliance label. |
|---|
| Practical decision rule | CPRA: treat this as the controlling workstream when the California-specific right, notice, contract term, or response clock is the blocker, and use the comparison row to check whether the same facts also trigger the Colorado law. | Colorado Privacy Act: run the comparator law as a separate workstream when its own scope, actor, or timing rule creates a different implementation step, rather than treating it as a duplicate of CPRA. | Choose the controlling law by the blocker in front of you: if the unresolved issue is a California CPRA duty, resolve CPRA first; if a Colorado-only duty remains, track Colorado separately; if both apply, keep both workstreams open. |
|---|