§ 6-1-1305-5

(1) A processor shall adhere to the instructions of a controller and shall assist the controller to meet the controller's obligations under sections 6-1-1308.5 and 6-1-1309.5, taking into account the nature of the processing and the information available to the processor. The processor shall assist the controller by: (a) Taking appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligations under section 6-1-1308.5; and(b) Providing information to enable the controller to conduct and document data protection assessments pursuant to section 6-1-1309.5.(2) A contract between a controller and a processor must satisfy the requirements in section 6-1-1305 (5).(3) Nothing in this section shall be construed to relieve a controller or processor from the liabilities imposed on the controller or processor by virtue of the controller's or processor's role in the processing relationship as described in sections 6-1-1308.5 and 6-1-1309.5.(4) Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which

d 6-1-1309.5.(4) Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data is to be processed. A person that is not limited in the person's processing of personal data pursuant to a controller's instructions, or that fails to adhere to the instructions, is a controller and not a processor with respect to a specific processing of data. A processor that continues to adhere to a controller's instructions with respect to a specific processing of personal data remains a processor. If a processor begins, alone or jointly with others, determining the purposes and means of the processing of personal data, the processor is a controller with respect to the processing and may be subject to an enforcement action under section 6-1-1311.Added by 2024 Ch. 296,§ 4, eff. 10/1/2025, app. to conduct occurring on or after the applicable effective date.Section 6(2) of chapter 296 (SB 24-041), Session Laws of Colorado 2024, provides that the act adding this section applies to conduct occurring on or after October 1, 2025.2024 Ch.

able effective date.Section 6(2) of chapter 296 (SB 24-041), Session Laws of Colorado 2024, provides that the act adding this section applies to conduct occurring on or after October 1, 2025.2024 Ch. 296, was passed without a safety clause. See Colo. Const. art. V, § 1(3).