Law / United States / 
Kentucky
Kentucky Consumer Data Protection Act, sensitive data and biometric data definitions
KRS 367.3611(28), 367.3611(3), 367.3617
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Obtain a Kentucky consumer's opt-in consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual.
- Treat a voiceprint or faceprint you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. Kentucky's exclusion for recording-derived data does not reach data generated for that purpose.
These lines are LexLint's reading of the law's text. Also read by: Office of the Kentucky Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx
- Guidance body
- Office of the Kentucky Attorney General
- Open questions
- Does the clause 'unless that data is generated to identify a specific individual or information collected, used, or stored for health care treatment, payment, or operations under HIPAA' in KRS 367.3611(3) lift the exclusion for HIPAA health care information, so that it counts as biometric data, or does it carve that information out of the definition altogether?
What it makes you log
Logging duty
KRS 367.3611 defines the terms, including sensitive data and biometric data, and KRS 367.3617 limits collection, requires security practices, requires consent before processing sensitive data and requires a privacy notice. Neither section requires a log, a register or a record the controller must be able to produce or demonstrate. Data protection assessments sit in KRS 367.3621, which this row does not cite. The territorial hook is the consumer definition's residence test in KRS 367.3611(7); the definitions section has no establishment or targeting prong.
- Kind
- None
- As of
What this law does
KCDPA classifies genetic or biometric data processed to uniquely identify a person as sensitive data, requiring opt-in consent under KRS 367.3617.
"Biometric data" means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual; a photograph, video, or audio recording, or data generated from one, is excluded only until that data is generated to identify a specific individual or is health care information governed by Health Insurance Portability and Accountability Act (HIPAA), at which point the general exclusion lifts. A 2026 amendment effective leaves this definition's operative text unchanged.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .