Law / United States / 
Kansas
Kansas Breach Notification Act, notice of security breach
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Conduct a good-faith, reasonable, and prompt investigation on becoming aware of a breach of system security involving personal information about a Kansas resident.NIST Privacy FrameworkPR.PO-P7
- Give notice to each affected Kansas resident as soon as possible, in the most expedient time possible and without unreasonable delay, if the investigation shows misuse occurred or is reasonably likely. There is no fixed numeric deadline in the statute; do not rely on a 45-day figure some secondary sources describe.NIST Privacy FrameworkCM.AW-P7
- Notify each nationwide consumer reporting agency if more than 1,000 Kansas consumers are affected by one breach.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text. Also read by: Office of the Kansas Attorney General (guidance, recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Attorney General's page describes itself as general information that is not to be relied upon as legal advice or guidance.
- As of
- Guidance link
- https://www.ag.ks.gov/divisions/public-protection/consumer-protection/your-identity
- Guidance body
- Office of the Kansas Attorney General
- Open questions
- Which 'primary or functional state or federal regulator' under K.S.A. 50-7a02(e) decides whether a regulated entity's own breach procedures are deemed compliant, when the entity answers to more than one regulator whose guidelines differ?
What it makes you log
Logging duty
Subsections (a) to (f) require a prompt good-faith investigation of a breach, notice to the affected Kansas resident, notice to the owner or licensee by a person that maintains the data, and notice to the nationwide consumer reporting agencies of the timing, distribution and content of the notices when more than 1,000 consumers are affected. These are duties to investigate and notify, and the subsections state no duty to keep or document a record of the breach and no audit or access to one; an entity's own notification procedures under an information security policy (subsection (d)) are a policy, not a record. The hook is the "conducts business in this state" prong of subsection (a).
- Kind
- None
- As of
What this law does
A person conducting business in Kansas, or a government, governmental subdivision, or agency that owns or licenses computerized personal information, must conduct a good-faith, reasonable, and prompt investigation on learning of a suspected breach and, if misuse occurred or is reasonably likely, give notice to the affected Kansas resident as soon as possible, in the most expedient time possible and without unreasonable delay.
The codified text sets no fixed numeric deadline, despite secondary-source claims of a 45-day figure, which does not appear anywhere in K.S.A. 50-7a02. Personal information is a name combined with a Social Security number, driver's license or state ID number, or financial account or card number with access credentials, and excludes publicly available government-record information; it does not reach biometric identifiers.
Notice to each nationwide consumer reporting agency is required when more than 1,000 consumers are affected at one time. Enacted 2006 (L. 2006, ch. 149, sec. 4), and the official history note gives July 1 as the day the section took effect.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .