Law / United States / 
Kentucky
Kentucky Consumer Data Protection Act, Attorney General enforcement
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect KCDPA violations to be enforced exclusively by the Kentucky Attorney General, never by a private plaintiff.
- Cure a noticed violation and confirm the cure in writing within 30 days of Attorney General notice to avoid damages of up to $7,500 per continued violation.
These lines are LexLint's reading of the law's text. Also read by: Office of the Kentucky Attorney General (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx
- Guidance body
- Office of the Kentucky Attorney General
- Open questions
- After a controller cures a noticed violation and gives the express written statement under KRS 367.3627(2), may the Attorney General still bring an action for an injunction, given that subsection (2) bars only an 'action for damages under subsection (3)'?
What it makes you log
Who may demand the log
Regulator
Logging duty
The Attorney General has exclusive enforcement authority and may demand information, documentary material or physical evidence from a controller or processor believed to be violating the Act. That is a power to demand what exists and names no record the controller or processor must keep. The 30-day cure process ends in an express written statement to the Attorney General that the violation is cured, which is a statement, not a log. The section has no scope clause of its own.
- Kind
- None
- As of
What this law does
The Kentucky Attorney General has exclusive authority to enforce KCDPA. Before suing, the Attorney General must give a controller or processor 30 days' written notice; curing the violation and confirming the cure in writing bars an action, and this 30-day cure period is permanent, unlike New Hampshire's and Rhode Island's time-limited or absent versions. An uncured, continuing violation is subject to damages of up to $7,500 per violation, and the statute creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .