13-44-201. Protection of personal information.
(1) Any person who conducts business in the state and maintains personal information shall implement and maintain reasonable procedures to: prevent unlawful use or disclosure of personal information collected or maintained in the regular course of business; and destroy, or arrange for the destruction of, records containing personal information that are not to be retained by the person.
(2) The destruction of records under Subsectionshall be by: (1)(b) shredding; erasing; or otherwise modifying the personal information to make the information indecipherable.