Kentucky Consumer Data Protection Act (KCDPA), general applicability and controller and processor duties

KRS 367.3611, 367.3613, 367.3617, 367.3619

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 9 months, effective 1 January 2026.

A comprehensive regime rule binding private bodies.

As of 27 August 2026.

What it requires

Determine whether you conduct business in Kentucky, or produce a product or service targeted to Kentucky residents, and control or process personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data, before relying on any KCDPA exemption.
Confirm whether a sector exemption applies. KCDPA excludes city and state government, Gramm-Leach-Bliley Act (GLBA)-covered financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, and higher-education institutions.
Limit collection to the purposes disclosed to the consumer, and use a written contract to bind any processor to your instructions.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

KCDPA applies to a person that conducts business in Kentucky, or produces a product or service targeted to Kentucky residents, and that during a calendar year controls or processes personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50 percent of gross revenue from the sale of personal data.

It exempts city and state government, Gramm-Leach-Bliley Act (GLBA)-covered financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, higher-education institutions, certain insurance-fraud investigative organizations, and small telephone, CMRS, or municipal utilities that do not sell personal data. Controllers must limit collection to disclosed purposes and processors act on the controller's instructions under a written contract. The enacting session law is 2024 Ky. Acts ch. 72, sec. 1, not ch. 89.

When LexLint raises it

automated_outreach
crawls_web
deploys_chatbot
processes_biometrics
processes_voice
trains_models

Read the law

official Kentucky statute text, KRS chapter 367, Kentucky Legislature website

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app