Law / United States / 
Kentucky
Kentucky Consumer Data Protection Act, data protection impact assessments
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection impact assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
- Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
- Make an assessment available to the Attorney General when it is requested under an investigative demand as relevant to an investigation.
- Apply the assessment duty to processing activities created or generated on or after , and not to earlier ones.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection impact assessment of targeted advertising, the sale of personal data, risky profiling, the processing of sensitive data and any processing that presents a heightened risk of harm to consumers (367.3621(1)), and the assessment must weigh the benefits of the processing against the risks to the consumer's rights (367.3621(2)). On an investigative demand the Attorney General may request an assessment, the controller must make it available, and the Attorney General may evaluate it for compliance with KRS 367.3611 to 367.3629 (367.3621(3)); assessments are confidential and exempt from disclosure under KRS 61.870 to 61.884 (367.3621(4)). The section sets no period for keeping an assessment. The section has no scope clause; the reach and the consumer definition are in KRS 367.3611 and 367.3613, which this row does not cite.
- Kind
- Explicit
- As of
- Provision
- KRS 367.3621(1), (2) and (3)
- Trigger
- personal_data_processing
What this law does
KCDPA requires a controller to conduct and document a data protection impact assessment of each of these processing activities involving personal data: targeted advertising, selling personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, the processing of sensitive data, and any processing that presents a heightened risk of harm to consumers.
Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards.
The Attorney General may request, pursuant to an investigative demand, that a controller disclose any such assessment relevant to an investigation, and the controller must make it available to the Attorney General, who may evaluate it for compliance with KRS 367.3611 to 367.3629.
Assessments are confidential and exempt from disclosure, public inspection and copying under KRS 61.870 to 61.884, and disclosing one to the Attorney General does not waive attorney-client privilege or work product protection. The assessment requirements apply to processing activities created or generated on or after .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or makes high-risk automated decisions.