Data Privacy Interactive Map - Kentucky

Highlights

Covered Entities: Referred to as information holder and includes persons or business entities that conducts business in Kentucky and maintain, own, or license personal information. It exempts persons subject to the GLBA, HIPAA, or any Kentucky agency or any of its local governments or political subdivisions.

Consumer Notification: Notification must be provided to any Kentucky resident whose unredacted and unencrypted personal information was acquired on an unauthorized basis that compromises the “security, confidentiality, or integrity” of that personal information that actually causes, or is reasonably believed to have caused or will cause, harm.

Regulatory Notification: N/A

Notification Timeline: Notice must be made in the “most expedient time possible and without unreasonable delay”.

Data Format: Electronic.

Citations: Ky. Rev. Stat. § 365.732.

More Details

Definitions:

• Breach: Unauthorized acquisition that compromises the “security, confidentiality, or integrity” of personal information that actually causes, or is reasonably believed to have caused or will cause, harm.
• Personal Information (PI) for businesses:
  • An individual's first name or first initial and last name in combination of one of the following data elements:
    • Social Security number;
    • Driver's license number; or
    • Account number or credit or debit card number, in combination with any required security code, access code, or password to permit access.
• Medical Information: N/A
• Health Insurance Information: N/A 

Safe Harbors:

• Encryption: A “breach” does not occur if the personal information was encrypted or redacted.
• Good Faith: Good-faith acquisition of personal information is not a breach if not used or subject to further unauthorized disclosure.
• Risk of Harm: Notification is not required if the entity reasonably believes the breach has not caused and will not cause identity theft or fraud against any resident.
• Law Enforcement Delay: Notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.

Direct Notice:

• Timing: Notice shall be made “most expedient time possible” and “without unreasonable delay”.
• Format: N/A
• Content: N/A
• Method: Written notice; or electronic notice, if the notice provided is “consistent with the provisions regarding electronic records and signatures” per E-SIGN.

Substitute Notice:

If notice would exceed $250,000, or the affected class of consumers exceeds 500,000, or the information holder does not have sufficient contact information substitute notice can be given in the following manner: (1) e-mail notice if entity has e-mail addresses for the affected consumers; (2) conspicuous posting of the notice on the web page of the entity; and (3) notification to major statewide media.

Remediation Services:

N/A 

Regulatory Notice:

N/A 

Credit Reporting Agencies Notice:

If notification includes more than 1,000 consumers, the entity shall also notify, without unreasonable delay, all consumer reporting agencies and credit bureaus that compile and maintain files on consumers on a nationwide basis.

Third-Party Notice:

An entity that maintains personal information that it does not own shall notify the owner or licensee of any breach as soon as reasonably practicable following discovery.

HIPAA:

The provisions of this statute shall not apply to any entity who is subject to the provisions of HIPAA.

Private Action:

N/A

Associated Regulations:

• Insurance Data Security (Ky. Rev. Stat. §§ 304.3-750 to 304.3-768)
• Information Security Standard for Government Agencies (Ky. Rev. Stat. § 61.932) 

Highlights

Covered Entities: Any entity licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of Kentucky, not including a purchasing group or a risk retention group chartered and licensed in a state other than Kentucky or a licensee that is acting as an assuming insurer that is domiciled in another state or jurisdiction.

Security Standard: A licensee must develop, implement, and maintain a comprehensive written information security program based on the licensee’s risk assessment that contains administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information and the licensee’s information systems. A licensee with fewer than (50) employees, including independent contractors, shall be exempt.

Consumer Notification: A licensee shall comply with the Kentucky Data Breach Statute enumerated in KRS 365.732.

Regulatory Notification: A licensee shall notify the Commissioner of Insurance as promptly as possible, but in no event later than 3 business days from a determination that a cybersecurity event involving nonpublic information of 250 or more residents that is in the possession of a licensee has occurred, when either of the criteria referenced below has been met.

Notification Timeline: As promptly as possible, but no later than 3 business days from a determination that a cybersecurity event involving nonpublic information that is in the possession of a licensee has occurred.

Citations: KRS 304.3-750 to 304.3-768.

More Details

Definitions:

• Consumer: An individual, including, but not limited to, an applicant, policyholder, insured, beneficiary, claimant, and certificate holder, who is a resident of Kentucky and whose nonpublic information is in the possession, custody, or control of a licensee.
• Cybersecurity Event: An event resulting in unauthorized access to, disruption, or misuse of an information system or nonpublic information stored on an information system, not including an event resulting in the unauthorized acquisition of encrypted nonpublic information or an event where the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.
• Licensee: Any entity licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of Kentucky, not including a purchasing group or a risk retention group chartered and licensed in a state other than Kentucky or a licensee that is acting as an assuming insurer that is domiciled in another state or jurisdiction. A licensee with fewer than fifty (50) employees, including independent contractors, shall be exempt from the requirements of KRS 304.3-750 to 304.3-768.
• Nonpublic Information: Electronic information that is not publicly available information and is any of the following:
  
  • Business-related information of a licensee that if tampered with, or disclosed, accessed, or used without authorization, would cause a material adverse impact to the business, operations, or security of the licensee.
  • Any confidential personal identifying information of a consumer, including:
    
    • Social Security number;
    • Operator’s license number or personal identification card number;
    • Financial account number or credit or debit card number;
    • Security code, access code, or password that would permit access to a consumer’s financial account; or
    • Biometric records.
  • Any information or data, except age or gender, created by or derived from a health care provider or a consumer, that can be used to identify a consumer and relates to:
    
    • The past, present, or future physical, mental, or behavioral health or condition of a consumer or a member of the consumer’s family;
    • The provision of health care to any consumer; or
    • The payment for the provision of health care to any consumer.

Regulatory Notice:

A licensee shall notify the Commissioner of Insurance as promptly as possible, but in no event later than 3 business days from a determination that a cybersecurity event involving nonpublic information in the possession of the licensee has occurred, when either of the following criteria has been met:

• Kentucky is the state of domicile of the licensee, in the case of an insurer, or the home state of the licensee, in the case of a producer, as those terms are defined in KRS 304.9-020, and the cybersecurity event has a reasonable likelihood of materially harming any material part of licensee’s operations.
• The licensee reasonably believes that the nonpublic information involves 250 or more consumers residing Kentucky and the cybersecurity event is either:
  
  • A cybersecurity event requiring the licensee the licensee to provide notice to any government body, self-regulatory agency, or any other supervisory body about pursuant to any state or federal law, or
  • A cybersecurity event that has a reasonable likelihood of materially harming either a consumer residing in Kentucky or a material part of licensee’s operations.

Content Requirements:

When notifying the Commissioner of Insurance of a cybersecurity event, a licensee shall provide, in an electronic form prescribed by the Commissioner, the following information:

• The date of the cybersecurity event.
• A description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of any third-party service providers.
• How the cybersecurity event was discovered.
• Whether any lost, stolen, or breached information has been recovered, and if so, how the information was recovered.
• The identity of the source of the cybersecurity event.
• Whether the licensee has filed a police report or has notified any regulatory, government, or law enforcement agencies and, if so, when the notification was provided.
• A description of the specific types of information acquired without authorization, including but not limited to types of medical information, financial information, or information allowing identification of the consumer.
• The period during which the information system was compromised by the cybersecurity event.
• The number of total consumers in this state affected by the cybersecurity event. The licensee shall provide the best estimate in the initial report to the commissioner and update this estimate with each subsequent report to the commissioner pursuant to this section.
• The results of any internal review identifying a lapse in either automated controls or internal procedures, or confirming that all automated controls or internal procedures were followed.
• A description of efforts being undertaken to remediate the situation that permitted the cybersecurity event to occur.
• A copy of the privacy policy of the licensee and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event.
• A copy of the notice sent to consumers under KRS 365.732, if applicable.
• The name of a contact person who is both familiar with the cybersecurity event and authorized to act for the licensee.

Third-Party Notice Requirements:

If a licensee discovers that a cybersecurity incident in a system maintained by a third-party service provider, the licensee shall treat the event in the same manner for purposes of notification to the Commissioner of Insurance unless the third-party service provider provides the notice. The licensee's deadlines shall begin on the earlier of the day after the third-party service provider notifies the licensee of the cybersecurity event; or the day the licensee otherwise has actual knowledge of the cybersecurity event, whichever is earlier.

Penalties:

An insurance producer violating this chapter may be penalized in accordance with KRS 304.99-020:

• For any violation of this code where the commissioner has the power to revoke or suspend a license or certificate of authority, the commissioner may in lieu thereof or in addition to such revocation or suspension impose a civil penalty against the violator in the case of an insurer, a fraternal benefit society, nonprofit hospital, medical-surgical, dental, and health service corporation, or health maintenance organization of not more than $10,000 per violation; in the case of an agent, surplus lines broker, rental vehicle agent or managing employee, specialty credit producer or managing employee, or reinsurance intermediary broker or manager of not more than $1,000 per violation; in the case of an adjuster, administrator, life settlement broker, life settlement provider, or consultant of not more than $2,000 per violation.
• Such civil penalty may be recovered in an action brought thereon in the name of the Commonwealth of Kentucky in any court of appropriate jurisdiction.
• In any court action with respect to a civil penalty, the court may review the penalty as to both liability and reasonableness of amount.

Associated Regulations:

N/A

Highlights

Covered Entities: An agency or non-affiliated third party that maintains or otherwise possesses personal information.

First Party Security Standard: An agency or non-affiliated third party that maintains or otherwise possesses personal information, regardless of the form in which the personal information is maintained, shall implement, maintain, and update security procedures and practices, including taking any appropriate corrective action, to protect and safeguard against security breaches.

Third Party Security Standard: For agreements executed or amended on or after January 1, 2015, any agency that contracts with a non-affiliated third party and that discloses personal information to the non-affiliated third party shall require as part of that agreement that the non-affiliated third party implement, maintain, and update security and breach investigation procedures that are appropriate to the nature of the information disclosed, that are at least as stringent as the security and breach investigation procedures and practices referenced in subsection (1)(b) of this section, and that are reasonably designed to protect the personal information from unauthorized access, use, modification, disclosure, manipulation, or destruction. 

Disposal/Destruction Standard: N/A

Data Format: Electronic and Paper.

Citations: KRS § 61.932.

More Details

Definitions:

• Personal Information (PI): An individual’s first name or first initial and last name; personal mark; or unique biometric or genetic print or image, in combination with one (1) or more of the following data elements
  
  • Account number, credit card number, or debit card number that, in combination with any required security code, access code, or password, would permit access to an account
  • Social Security number;
  • Taxpayer identification number that incorporates a Social Security number;
  • Driver's license number, state identification card number, or other individual identification number issued by any agency;
  • Passport number or other identification number issued by the United States government; or
  • Individually identifiable health information as defined in 45 C.F.R. sec. 160.103, except for education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. sec. 1232g;

Methods of Compliance:

The statute does not define what constitutes reasonable security procedures and practices.

Public Agencies and Nonaffiliated Third-parties

Reasonable security and breach investigation procedures and practices established and implemented by organizational units of the executive branch of state government shall be in accordance with relevant enterprise policies established by the Commonwealth Office of Technology.

Reasonable security and breach investigation procedures and practices established and implemented by units of government listed under KRS 61.931(1)(b) and (c) that are not organizational units of the executive branch of state government shall be in accordance with policies established by the Department for Local Government. The Department for Local Government shall consult with public entities as defined in KRS 65.310 in the development of policies establishing reasonable security and breach investigation procedures and practices for units of local government pursuant to this subsection.

Reasonable security and breach investigation procedures and practices established and implemented by public school districts listed under KRS 61.931(1)(d) shall be in accordance with administrative regulations promulgated by the Kentucky Board of Education.

Reasonable security and breach investigation procedures and practices established and implemented by educational entities listed under KRS 61.931(1)(e) shall be in accordance with policies established by the Council on Postsecondary Education.

The Commonwealth Office of Technology shall, upon request of an agency, make available technical assistance for the establishment and implementation of reasonable security and breach investigation procedures and practices.

If an agency is subject to any additional requirements under the Kentucky Revised Statutes or under federal law, protocols, or agreements relating to the protection and privacy of personal information, the agency shall comply with these additional requirements, in addition to the requirements of KRS 61.931 to 61.934.

If a nonaffiliated third party is required by federal law or regulation to conduct security breach investigations or to make notifications of security breaches, or both, as a result of the nonaffiliated third party's unauthorized disclosure of one (1) or more data elements of personal information that is the same as one (1) or more of the data elements of personal information listed in KRS 61.931(6)(a) to (f), the nonaffiliated third party shall meet the requirements of KRS 61.931 to 61.934 by providing to the agency a copy of any and all reports and investigations relating to such security breach investigations or notifications that are required to be made by federal law or regulations. This subparagraph shall not apply if the security breach includes the unauthorized disclosure of data elements that are not covered by federal law or regulation but are listed in KRS 61.931(6)(a) to (f).

Exclusions:

N/A

Enforcement/Penalties:

N/A

Associated Regulations:

N/A

Public Agencies and Nonaffiliated Third-parties:

Kentucky Revised Statutes, KRS 61.931, Definitions for KRS 61.931 to 61.934

Data Controllers (Kentucky Consumer Data Protection Act):

Kentucky Revised Statutes, KRS 367.3617 (requiring data controllers to whom the Act applies to establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data.)

KRS §§ 367.3611 to 367.3629

Highlights

Applicability:

The Kentucky Consumer Data Protection Act (“KCDPA”) applies to any person or entity that conducts business in the Commonwealth of Kentucky or produces products or services that are targeted to residents of the Commonwealth, and that, during a calendar year, satisfies at least one of the following two thresholds:

• Controls or processes the Personal Data of at least 100,000 consumers; or
• Controls or processes the Personal Data of at least 25,000 consumers AND derives over 50 percent of its gross revenue from the sale of Personal Data.

However, certain entities are excluded from the scope of the KCDPA. Among other exclusions, the act excludes a city, state agency, or any political subdivision of the state,, nonprofit organizations, institutions of higher education, financial institutions subject to Title V of the Gramm-Leach-Bliley Act (GLBA), as well as personal data subject to Title V of the GLBA, and covered entities and business associatesgoverned by the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services under HIPAA and HITECH. .

The KCDPA excludes certain additional entities, including qualifying insurance-fraud-prevention entities; small telephone utilities as defined in KRS § 278.516; Tier III commercial mobile radio service providers; and municipally owned utilities that do not sell or share personal data with third-party processors.

The KCDPA also excludes certain categories of information, such as protected health information under HIPAA, certain health records, patient identifying information, and information regulated by the Health Care Quality Improvement Act of 1986, the Fair Credit Reporting Act, the Driver’s Privacy Protection Act of 1994, the Family Educational Rights and Privacy Act, and the Farm Credit Act of 1971, as well as employment-related data, emergency contact information.

As amended by 2025 H.B. 473, the KCDPA also excludes information collected by a health care provider that is a HIPAA covered entity and that maintains protected health information in accordance with HIPAA, as well as information included in a limited data set as described in 45 C.F.R. § 164.514(e), to the extent the information is used, disclosed, and maintained in the manner specified by that regulation.

The KCDPA further excludes, among other categories, certain human-subjects research information; identifiable private information used in research; patient safety work product; information derived from health care-related information that has been deidentified in accordance with HIPAA; public-health information authorized by HIPAA; personal data maintained by a utility or an affiliate or holding company of a utility; and personal data collected and used solely for purposes of the federal Combat Methamphetamine Epidemic Act of 2005.

Controller Obligations:

• Limit the collection of Personal Data to what is adequate, relevant, and reasonably necessary to the purposes for which the data is processed as disclosed to the consumer.
• Refrain from processing Personal Data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which the Personal Data is processed as disclosed to the consumer, unless the controller obtains the consumer's consent.
• Establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the Personal Data at issue to protect the confidentiality, integrity, and accessibility of Personal Data.
• Not process Personal Data in violation of state and federal laws that prohibit unlawful discrimination against consumers and not discriminate against consumers who exercise such rights including by denying goods or services, charging different prices or rates, or providing a different level of quality of goods or services. This obligation does not require a controller to provide a product or service that requires Personal Data the controller does not collect or maintain, and does not prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services, including goods or services offered for no fee, if the offer is related to the consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
• Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data collected from a known child, process the data in accordance with the federal Children's Online Privacy Protection Act.
• Provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes the categories of Personal Data processed by the controller, the purpose for processing Personal Data, how consumers may exercise their consumer rights including how a consumer may appeal a controller's decision with regard to the consumer's request, the categories of Personal Data that the controller shares with third parties, if any, and the categories of third parties, if any, with whom the controller shares Personal Data.
• If a Controller sells Personal Data to third parties or processes Personal Data for targeted advertising, the controller shall clearly and conspicuously disclose such activity, as well as the manner in which a consumer may exercise the right to opt out of processing.
• Establish and describe in a privacy notice, one (1) or more secure and reliable means for consumers to submit a request to exercise their consumer rights that take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the controller’s ability to authenticate the identity of the consumer making the request. A controller may not require a consumer to create a new account to exercise consumer rights, but may require the consumer to use an existing account.
• Conduct and document a data protection impact assessment of certain types of processing activities involving Personal Data that present a heightened risk of harm to consumers, such as for:
  • Targeted advertising.
  • Selling Personal Data.
  • Profiling that presents a reasonably foreseeable risk of: unfair or deceptive treatment of or unlawful disparate impact on consumers; financial, physical, or reputational injury to consumers; a physical or other intrusion on consumers' solitude, seclusion, private affairs, or private concerns, if it would offend a reasonable person; or another substantial consumer injury.
  • Processing Sensitive Data.
  • Any processing of Personal Data that presents a heightened risk of harm to consumers.
• Data protection impact assessments must identify and weigh the benefits that may flow from the processing to the controller, consumer, other stakeholders, and the public against the potential risks to the rights of the consumer, as mitigated by safeguards that the controller can employ. The assessment must factor in the use of deidentified data, reasonable consumer expectations, the context of processing, and the relationship between the controller and the consumer.
• The Attorney General may request, pursuant to an investigative demand, that a controller disclose a relevant data protection impact assessment. The assessment is confidential and exempt from public disclosure, and disclosure to the Attorney General does not waive attorney-client privilege or work-product protection. A single assessment may address a comparable set of processing operations, and assessments conducted for other laws may satisfy the KCDPA if they have a reasonably comparable scope and effect.
• The data protection impact assessment requirements apply to processing activities created or generated on or after June 1, 2026.
• Act on and respond to consumers’ requests to exercise their personal data rights.
• 2027 FUTURE AMENDMENT: Effective July 1, 2027, a Controller may not collect automatic content recognition data without the consumer’s consent.

Consumer Rights:

A Controller must respond without undue delay and within forty-five (45) days to verified consumer requests regarding the processing of Personal Data, including consumers’:

• Right to confirm whether or not a Controller is processing the consumer’s Personal Data and to access the Personal Data, unless confirmation and access would require the Controller to reveal a trade secret. ;
• Right to correct inaccurate Personal Data, taking into account the nature of the Personal Data and the purposes of processing the data;
• Right to request deletion of Personal Data provided by or obtained about the consumer;
• Right to obtain a copy of the consumer’s Personal Data that the consumer previously provided to the Controller in a portable, and to the extent technically practicable, readily usable, format that allows the consumer to transit the data to another Controller without hindrance, where the processing is carried out by automated means and is transmittable. The Controller is not required to reveal any trade secrets
• Right to opt out of the processing of Personal Data for purposes of targeted advertising, the sale of Personal Data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
• A Controller may not discriminate against a consumer for exercising consumer rights under KRS § 367.3615, subject to the KCDPA’s exceptions for products or services requiring Personal Data the Controller does not collect or maintain and bona fide loyalty, rewards, premium features, discounts, or club card programs.Additionally, a Controller shall establish a process for the consumer to appeal the Controller’s refusal to take action on a request within a reasonable period of time after the consumer receives the decision. The appeal process must be made conspicuously available and similar to the process for submitting requests to initiate action. The Controller is required to inform the consumer in writing of any action taken or not taken in response to the appeal within sixty (60) days of receipt of an appeal and include a written explanation of the reasons for the decisions. If the appeal is denied, the Controller must also provide an online mechanism, if available, for the consumer to contact the Attorney General to submit a complaint.

Additionally, a Controller shall establish a process for the consumer to appeal the Controller’s refusal to take action on a request within a reasonable period of time after the consumer receives the decision. The appeal process must be made conspicuously available and similar to the process for submitting requests to initiate action. The Controller is required to inform the consumer in writing of any action taken or not taken in response to the appeal within sixty (60) days of receipt of an appeal and include a written explanation of the reasons for the decisions. If the appeal is denied, the Controller must also provide an online mechanism, if available, for the consumer to contact the Attorney General to submit a complaint.

More Details

Definitions:

• Authenticate: Verifying through reasonable means that the consumer entitled to exercise consumer rights under the KCDPA is the same consumer exercising those rights with respect to the Personal Data at issue.
• Child: An individual under the age of 13.
• Consent: A clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process Personal Data relating to the consumer. Consent may include a written statement, written by electronic means, or any other unambiguous affirmative action.
• Consumer: A natural person who is a resident of the Commonwealth of Kentucky acting only in an individual context. Consumer does not include a natural person acting in a commercial or employment context.
• Controller: A natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.
• Decisions that produce legal or similarly significant effects concerning a consumer: A decision made by a controller that results in the provision or denial by the controller of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities like food and water.
• De-identified Data: Data that cannot reasonably be linked to an identified or identifiable natural person or a device linked to a person.
• Personal Data: Any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal data does not include de-identified data or publicly available information (defined as information lawfully made available from federal, state, or local government records, or that a business reasonably believes is lawfully made available to the general public through widely distributed media by the consumer or a person the consumer has disclosed the information to without restricting the information to a specific audience).
• Precise Geolocation Data: Information derived from technology, including global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet. Precise geolocation data does not include the content of communications or data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
• Processor: A natural or legal entity that processes Personal Data on behalf of a Controller.
• Profiling: Any form of automated processing of Personal Data to evaluate, analyze, or predict personal aspects relating to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.Pseudonymous Data: Personal Data that cannot be attributed to a specific natural person without the use of additional information, provided that the additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the Personal Data is not attributed to an identified or identifiable natural person.
• Sale of Personal Data: The exchange of Personal Data for monetary consideration by the Controller to a third party. The sale excludes the following disclosures from this definition:  (i) disclosure to a processor for processing on behalf of the Controller; (ii) disclosures to a third party to provide a product or service requested by the Consumer; (iii) disclosures or transfers of Personal Data to an affiliate of the Controller; (iv) disclosures of information that the consumer intentionally made available to the general public via a channel of mass media and did not restrict to a specific audience; (v) a disclosure or transfer as an asset in a merger or other transaction in which the third party assumes control of all or part of the Controller’s assets.
• Sensitive Data: Personal Data revealing:  racial or ethnic origin, religious beliefs, mental/physical health diagnosis, sexual orientation, or citizenship/citizenship status; genetic and biometric data that is processed for the purpose of uniquely identifying a specific natural person; Personal Data collected from a known child or precise geolocation data.
• Targeted Advertising: Displaying to a consumer advertisement based on personal information obtained from consumer’s activities over time and across nonaffiliated websites or applications to predict their interests or preferences. Excludes: (i) advertisement based on activities within the Controllers own or affiliated websites or online applications; (ii) advertisement based on the context of consumers current search query or visit to a website/application; (iii) advertisement directed to the consumer in response to their request; or (iv) Personal Information Processed solely for measuring or reporting advertisement performance.
• Third Party: A natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or controller.
• Trade Secret: Has the same meaning as in means information, including a formula, pattern, compilation, program, data, device, method, technique, or process, that: (a) Derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use, and (b) Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.  

Amendment effective July 1, 2027 Definitions:

• Automatic Content Recognition Data: Data about a consumer’s content viewing history collected through the use of technology that is embedded or operated through a smart television or smart monitor, integrated with internet connectivity and an operating system, that identifies, in real time, the specific content displayed by analyzing audio or video fingerprints, including but not limited to content received through broadcast, cable, satellite, streaming services, or external inputs, through digital fingerprinting, watermark detection, or similar comparison techniques. The term does not include data: (i) collected about a consumer’s interactions with content provided by the controller’s own services; (ii) generated in the course of providing a feature or service requested by a consumer; or (iii) collected for the purpose of enforcing terms of service.
• Biometric Data: Data generated by automatic measurements of an individual’s biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that are used to identify a specific individual. Biometric data does not include a physical or digital photograph, video or audio recording, or data generated from a photograph or recording, unless the data is generated to identify a specific individual. Biometric data also does not include information collected, used, or stored for health care treatment, payment, or operations under HIPAA.
• Smart Monitor: A digital display device that integrates hardware and software components to enable internet connectivity, application execution, and media content streaming independently of an external computer or media source. The term does not include a voice assistant device or mobile device.
• Sensitive Data: Effective July 1, 2027, “sensitive data” will include automatic content recognition data, in addition to the existing categories of sensitive data under the KCDPA.

Penalties:  

Violations of the KCDPA may be enforced exclusively by the Attorney General with a thirty (30) day cure period. Before initiating an action, the Attorney General must provide a controller or processor thirty (30) days’ written notice identifying the specific provisions allegedly violated. If the controller or processor cures the violation within the thirty (30) day period and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations will occur, the Attorney General may not initiate an action for damages based on the cured violation. The maximum civil penalty for violations is $7,500 per violation. If a controller or processor continues to violate the KCDPA after the cure period or breaches the written cure statement, the Attorney General may initiate an action and seek damages of up to $7,500 for each continued violation. The Attorney General may also recover reasonable expenses incurred in investigating and preparing the case, court costs, attorney’s fees, and other relief ordered by the court.

Private Action:

No

Enforcement Action:

Associated Regulations & Rulemaking:

N/A

Notes on AI Related Regulations:

The KCDPA is not a standalone AI law, but it regulates AI-adjacent processing through its provisions on profiling, targeted advertising, sensitive data, and data protection impact assessments. Controllers must allow consumers to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, and must conduct data protection impact assessments for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical, or reputational injury, offensive intrusion on privacy, or other substantial injury.

Effective Date:

January 1, 2026; HB 692 amendment effective July 1, 2027.