Law / United States / 
Kentucky
Kentucky Consumer Data Protection Act (KCDPA), general applicability and controller and processor duties
KRS 367.3611, 367.3613, 367.3617, 367.3619
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Independent third party
- Where the report goes
- Produced on request
What it requires
- Determine whether you conduct business in Kentucky, or produce a product or service targeted to Kentucky residents, and control or process personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data, before relying on any KCDPA exemption.
- Confirm whether a sector exemption applies. KCDPA excludes city and state government, Gramm-Leach-Bliley Act (GLBA)-covered financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, and higher-education institutions.
- Limit collection to the purposes disclosed to the consumer, and use a written contract to bind any processor to your instructions.
These lines are LexLint's reading of the law's text. Also read by: Office of the Kentucky Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx
- Guidance body
- Office of the Kentucky Attorney General
- Open questions
- Does KRS 367.3613(2)(b), which exempts 'Financial institutions, their affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act', exempt an affiliate of a financial institution for all of its processing, or only for data subject to Title V?
What it makes you log
Who may demand the log
Counterparty
Logging duty
A processor has to be able to show the controller on request that it complies with the Act, and has to allow the controller's assessments or arrange an independent assessment and hand over the report; none of that can be done without records, though the section names no log and lists no fields. KRS 367.3619(1)(c) refers to the controller's documented data protection assessments, which sit in KRS 367.3621, a section this row does not cite, so nothing is taken from it. KRS 367.3617 states limits on collection, security practices, a consent rule for sensitive data and a privacy notice, and no record duty. No section cited here sets a period for keeping any record. The controller's own assessment route has no value in the audit vocabulary, so only the independent assessor is listed.
- Kind
- Implicit
- As of
- Provision
- KRS 367.3619(2)(c) and (d) (a processor makes available to the controller the information needed to demonstrate its compliance, cooperates with the controller's assessments or delivers an independent assessor's report on request)
- Trigger
- personal_data_processing
What this law does
KCDPA applies to a person that conducts business in Kentucky, or produces a product or service targeted to Kentucky residents, and that during a calendar year controls or processes personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50 percent of gross revenue from the sale of personal data.
It exempts city and state government, Gramm-Leach-Bliley Act (GLBA)-covered financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, higher-education institutions, certain insurance-fraud investigative organizations, and small telephone, CMRS, or municipal utilities that do not sell personal data. Controllers must limit collection to disclosed purposes and processors act on the controller's instructions under a written contract. The enacting session law is 2024 Ky. Acts ch. 72, sec. 1, not ch. 89.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .