Covered entities that maintain protected personal or personally identifying information (PII) must take reasonable steps to protect that information, to dispose of it when it is no longer needed, and to promptly notify Colorado residents when their information is at risk of misuse by unauthorized third parties.