In 2021, the general assembly enacted Senate Bill 21-190, which established the "Colorado Privacy Act" (privacy act) as part of the "Colorado Consumer Protection Act". The privacy act protects the privacy of individuals' personal data by establishing certain requirements for entities that process personal data. The privacy act also describes certain rights that consumers may exercise regarding the processing of their personal data. The privacy act includes additional protections for sensitive data. For the purposes of the privacy act, the bill expands the definition of "sensitive data" to include biological data, which is data that provides a characterization of the biological, genetic, biochemical, or physiological properties, compositions, or activities of an individual's body or bodily functions generated by the technological processing, measurement, or analysis of an individual's biological, genetic, biochemical, physiological, or neural properties, compositions, or activities or of an individual's body or bodily functions, which data is used or intended to be used, singly or in combination with other personal data, for identification purposes. Biological data includes neural data, which is information that concerns the activity of an individual's central nervous system or peripheral nervous systems, including the brain and spinal cord, and that can be processed by or with the assistance of a device is generated by the measurement of the activity of an individual's central or peripheral nervous systems and that can be processed by or with the assistance of a device. (Note: Italicized words indicate new material added to the original summary; dashes through words indicate deletions from the original summary.) (Note: This summary applies to the reengrossed version of this bill as introduced in the second house.)