Law / United States / 
Kentucky
Security and breach investigation procedures and practices for public agencies and nonaffiliated third parties
Public agency personal information security procedures, KRS 61.931, 61.932 and 61.934
In force since .
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds each agency: the executive branch of state government; every county, city, municipal corporation and other local government, and every unit, board, commission, authority or public corporation of or controlled by one; every public school district; and every public institution of postsecondary education. The legislative and judicial branches of state government are bound by KRS 61.934.
- Implement, maintain, and update written security and breach investigation procedures and practices, including taking any appropriate corrective action, to protect and safeguard against security breaches the personal information you maintain or possess, in the form it is kept.
- Make those procedures and practices accord with the enterprise policies of the Commonwealth Office of Technology if you are an executive branch unit, the policies of the Department for Local Government if you are a local government unit, the administrative regulations of the Kentucky Board of Education if you are a public school district, or the policies of the Council on Postsecondary Education if you are a public postsecondary institution.
- In an agreement executed or amended on or after with a nonaffiliated third party to which you disclose personal information, require the third party to implement, maintain, and update security and breach investigation procedures appropriate to the information and at least as stringent as yours, and specify how the cost of the notification and investigation requirements of KRS 61.933 is apportioned.
- If you are in the legislative or judicial branch of state government, implement, maintain, and update reasonable security and breach investigation procedures and practices, including taking any appropriate corrective action, consistent with KRS 61.931 to 61.934.
- Comply with any additional requirements under the Kentucky Revised Statutes or under federal law, protocols, or agreements relating to the protection and privacy of personal information.
These lines are LexLint's reading of the law's text, as of .
What this law does
An agency or nonaffiliated third party that maintains or otherwise possesses personal information must implement, maintain, and update security procedures and practices, including taking any appropriate corrective action, to protect and safeguard against security breaches.
An agency is the executive branch of state government, every county, city, municipal corporation, urban-county government, charter county government, consolidated local government, and unified local government, every public school district, and every public institution of postsecondary education, together with the units and bodies of the first two groups.
Reasonable security and breach investigation procedures and practices are data security procedures and practices developed in good faith and set forth in a written security information policy. Procedures of executive branch organizational units must be in accordance with relevant enterprise policies established by the Commonwealth Office of Technology. Procedures of local governments must be in accordance with policies established by the Department for Local Government.
Procedures of public school districts must be in accordance with administrative regulations promulgated by the Kentucky Board of Education. Procedures of public postsecondary educational entities must be in accordance with policies established by the Council on Postsecondary Education.
An agency that discloses personal information to a nonaffiliated third party under an agreement executed or amended on or after must require the third party to implement, maintain, and update security and breach investigation procedures that are appropriate to the information and at least as stringent as the procedures and practices referenced in subsection (1)(b) of the section.
The legislative and judicial branches of state government must implement, maintain, and update reasonable security and breach investigation procedures and practices, including taking any appropriate corrective action, consistent with KRS 61.931 to 61.934. The sections took effect on .