Law / United States / 
Kansas
Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Retention
What it requires
- This binds any holder of personal information: any individual, partnership, corporation, trust, estate, cooperative, association, government, governmental subdivision, agency, or other entity that in the ordinary course of business collects, maintains, or possesses another person's personal information.
- Implement and maintain reasonable procedures and practices appropriate to the nature of the information, and exercise reasonable care to protect it from unauthorized access, use, modification, or disclosure. Being subject to and compliant with another federal or state law or regulation governing the same procedures and practices is deemed compliance with this duty.NIST CSF 2.0PR.DS-01
- Unless a federal law or regulation requires otherwise, destroy or arrange for the destruction of records containing personal information once you no longer intend to maintain or possess them, by shredding, erasing, or otherwise rendering the personal information unreadable or undecipherable.NIST CSF 2.0ID.AM-08
- There is no private right of action. Only the Kansas Attorney General may enforce this section, as an unconscionable act or practice under the Kansas Consumer Protection Act, seeking a civil penalty of up to $10,000 per violation under K.S.A. 50-636.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- 3.5Destroying data in a way that fits its sensitivity and storage type.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civil penalty under K.S.A. 50-636(a) for a violation deemed an unconscionable act or practice under K.S.A. 50-627; the statute names no aggregate cap and each undestroyed record is a separate violation. Kansas's separate breach-notification statute, K.S.A. 50-7a01 through 50-7a04, carries its own enforcement provisions and is filed under this jurisdiction's privacy row.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
K.S.A. 50-6,139b names no dedicated regulator of its own; a violation is deemed an unconscionable act or practice under K.S.A. 50-627, and the exclusive authority to bring an action for any violation, for injunctive relief and a civil penalty under K.S.A. 50-636 of up to $10,000 per violation, rests with the Kansas Attorney General.
What this law does
Any holder of personal information, defined to include any individual, partnership, corporation, trust, estate, cooperative, association, government, governmental subdivision, agency, or other entity that in the ordinary course of business collects, maintains, or possesses another person's personal information, must implement and maintain reasonable procedures and practices appropriate to the nature of the information and exercise reasonable care to protect it from unauthorized access, use, modification or disclosure.
Compliance with another federal or state law or regulation governing the same procedures and practices is deemed compliance with this safeguards duty, and failure to comply with that other law is prima facie evidence of a violation.
Unless federal law requires otherwise, a holder must also take reasonable steps to destroy or arrange for the destruction of records containing personal information it no longer intends to maintain or possess, by shredding, erasing, or otherwise rendering the information unreadable. A holder has an affirmative defense to a violation of the destruction duty where the failure could not reasonably have been foreseen despite the holder's exercise of reasonable care in selecting a destruction method.
The defense is also available where the holder had a bona fide written or electronic records management policy reasonably designed to prevent the violation, its employees received training on the policy, the violation was a good faith error, and no reasonable likelihood exists that it may cause, enable or contribute to identity theft or identity fraud.
Each violation of this section is an unconscionable act or practice under the Kansas Consumer Protection Act's unconscionability provision, section 50-627, with each undestroyed record its own separate violation. Only the Kansas Attorney General may enforce this section. The Attorney General may seek a civil penalty of up to $10,000 per violation under the Act's civil-penalties provision, section 50-636. The section itself creates no private right of action.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .