{
  "type": "practice-guide",
  "canonical": "https://openagreements.org/practice-guides/privacy/us/kentucky",
  "links": [
    {
      "rel": "self",
      "href": "https://openagreements.org/practice-guides/privacy/us/kentucky.json",
      "type": "application/json"
    },
    {
      "rel": "alternate",
      "href": "https://openagreements.org/practice-guides/privacy/us/kentucky",
      "type": "text/html"
    },
    {
      "rel": "alternate",
      "href": "https://openagreements.org/practice-guides/privacy/us/kentucky/markdown",
      "type": "text/markdown"
    },
    {
      "rel": "alternate",
      "href": "https://openagreements.org/practice-guides/privacy/us/kentucky/json",
      "type": "application/json"
    }
  ],
  "data": {
    "topic": "privacy",
    "state": "kentucky",
    "frontmatter": {
      "title": "Kentucky Consumer Privacy Law (KCDPA)",
      "description": "The Kentucky Consumer Data Protection Act, effective January 1, 2026, gives Kentucky consumers rights over their personal data and imposes notice, contracting, and consent duties on controllers above defined thresholds — closely modeled on Virginia, it is enforced exclusively by the Attorney General with a permanent 30-day cure period and provides no private right of action.",
      "state": "Kentucky",
      "lastReviewed": "2026-06-06",
      "license": "CC BY 4.0",
      "authors": [
        "steven-obiajulu"
      ],
      "summary": {
        "keyLaw": "KRS 367.3611 to 367.3629 (Kentucky Consumer Data Protection Act), effective January 1, 2026",
        "appliesTo": "Persons doing business in Kentucky (or targeting residents) that control or process the data of 100,000+ consumers a year, or 25,000+ while deriving over 50% of gross revenue from selling data — no revenue floor; nonprofits and higher-education institutions exempt",
        "privacyPolicyRequired": "Yes — a reasonably accessible, clear, and meaningful notice with statutorily fixed contents",
        "privateRightOfAction": "No — enforcement is exclusively the Attorney General's",
        "regulator": "Kentucky Attorney General (exclusive)",
        "bottomLine": "If you meet the 100,000-consumer (or 25,000 plus majority-data-sale) threshold in Kentucky, the KCDPA requires a privacy notice, opt-in consent to process sensitive data, and processor contracts — enforced by the Attorney General with a permanent 30-day cure period and no consumer lawsuits.",
        "lawCoverage": "comprehensive",
        "policyMandate": "statutoryContents",
        "consumersCanSue": "no",
        "sensitiveDataConsent": "optIn",
        "universalOptOutSignal": "notRequired"
      },
      "about": [
        "Kentucky Consumer Data Protection Act KCDPA",
        "Kentucky privacy policy requirements",
        "Kentucky privacy notice contents",
        "KCDPA applicability thresholds",
        "KCDPA sensitive data consent",
        "KCDPA processor contract requirements",
        "Kentucky Attorney General privacy enforcement",
        "KCDPA no private right of action"
      ],
      "translations": [
        {
          "language": "中文",
          "status": "planned"
        },
        {
          "language": "Español",
          "status": "planned"
        },
        {
          "language": "Português",
          "status": "planned"
        },
        {
          "language": "Deutsch",
          "status": "planned"
        }
      ]
    },
    "questions": [
      {
        "slug": "does-kcdpa-apply",
        "label": "Does the Kentucky Consumer Data Protection Act apply to your business?",
        "heading": "Does the Kentucky Consumer Data Protection Act apply to your business?",
        "answerText": "It turns on consumer volume, not revenue. The KCDPA applies to persons that do business in Kentucky or target its residents and that, in a calendar year, control or process the personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data.",
        "sources": [
          {
            "id": "stat-3613-apply",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "KRS 367.3613",
            "citation": "KRS 367.3613(1).",
            "url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648",
            "proposition": "The KCDPA applies to persons doing business in Kentucky or targeting its residents that control or process the data of at least 100,000 consumers, or 25,000+ while deriving over 50% of gross revenue from selling personal data.",
            "verbatimQuote": "KRS 367.3611 to 367.3629 apply to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that during a calendar year control or process personal data of at least: (a) One hundred thousand (100,000) consumers; or (b) Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/kentucky#src-stat-3613-apply"
          }
        ]
      },
      {
        "slug": "privacy-policy-contents",
        "label": "What must your Kentucky privacy policy contain?",
        "heading": "What must your Kentucky privacy policy contain?",
        "answerText": "A controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal data processed, the purpose for processing, how consumers exercise their rights (including how to appeal), the categories of personal data shared with third parties, and the categories of those third parties.",
        "sources": [
          {
            "id": "stat-3617-notice",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "KRS 367.3617",
            "citation": "KRS 367.3617(3).",
            "url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839",
            "proposition": "A controller must provide a reasonably accessible, clear, and meaningful privacy notice listing the categories of personal data processed and the purpose for processing, among other required disclosures.",
            "verbatimQuote": "reasonably accessible, clear, and meaningful privacy notice that includes: (a) The categories of personal data processed by the controller; (b) The purpose for processing personal data;",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/kentucky#src-stat-3617-notice"
          }
        ]
      },
      {
        "slug": "vendor-contracts",
        "label": "What must your contracts with processors say?",
        "heading": "What must your contracts with processors say?",
        "answerText": "A contract between a controller and a processor must govern the processor's data processing on the controller's behalf — so a data processing agreement is a statutory requirement, not a best practice.",
        "sources": [
          {
            "id": "stat-3619-contract",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "KRS 367.3619",
            "citation": "KRS 367.3619(2).",
            "url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55840",
            "proposition": "A contract between a controller and a processor must govern the processor's data processing performed on behalf of the controller.",
            "verbatimQuote": "A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/kentucky#src-stat-3619-contract"
          },
          {
            "id": "stat-3619-terms",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "KRS 367.3619",
            "citation": "KRS 367.3619(2).",
            "url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55840",
            "proposition": "The controller-processor contract must set forth processing instructions, the nature and purpose of processing, the type of data and duration, and must require the processor to maintain confidentiality, delete or return data, demonstrate compliance, cooperate with assessments, and bind subcontractors to the same obligations.",
            "verbatimQuote": "The contract shall be binding and shall clearly set forth instructions for processing personal data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties. The contract shall also include requirements that the processor shall: (a) Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data; (b) At the controller's direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law; (c) Upon the reasonable request of the controller, make available to the controller all information in its possession necessary to demonstrate the processor's compliance with the obligations prescribed in KRS 367.3611 to 367.3629; (d) Allow, and cooperate with, reasonable assessments by the controller or the controller's designated assessor. Alternatively, the processor may arrange for a qualified and independent assessor to conduct an assessment of the processor's policies and technical and organizational measures in support of the obligations in KRS 367.3611 to 367.3629 using an appropriate and accepted control standard or framework and assessment procedure for assessments. The processor shall provide a report of the assessment to the controller upon request; and (e) Engage any subcontractor pursuant to a written contract in accordance with this section that requires the subcontractor to meet the obligations of the processor with respect to the personal data.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/kentucky#src-stat-3619-terms"
          }
        ]
      },
      {
        "slug": "sensitive-data",
        "label": "Do you need consent to process sensitive data?",
        "heading": "Do you need consent to process sensitive data?",
        "answerText": "Yes. A controller may not process a consumer's sensitive data without first obtaining consent, and for a known child it must instead follow the federal Children's Online Privacy Protection Act. Sensitive data includes data indicating race or ethnicity, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to uniquely identify a person; data from a known child; and precise geolocation.",
        "sources": [
          {
            "id": "stat-3617-consent",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "KRS 367.3617",
            "citation": "KRS 367.3617(1)(e).",
            "url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839",
            "proposition": "A controller may not process a consumer's sensitive data without consent, and must handle a known child's data in accordance with COPPA.",
            "verbatimQuote": "Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data collected from a known child, process the data in accordance with the federal Children's Online Privacy Protection Act, 15 U.S.C. sec. 6501 et seq.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/kentucky#src-stat-3617-consent"
          }
        ]
      },
      {
        "slug": "consumer-lawsuit",
        "label": "Can a consumer sue your business under the KCDPA?",
        "heading": "Can a consumer sue your business under the KCDPA?",
        "answerText": "No. The Attorney General has exclusive authority to enforce the KCDPA, so there is no private right of action for consumers. Before suing, the Attorney General must give 30 days' written notice of the specific alleged violations and a chance to cure.",
        "sources": [
          {
            "id": "stat-3627-enforce",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "KRS 367.3627",
            "citation": "KRS 367.3627(1).",
            "url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55844",
            "proposition": "The Attorney General has exclusive authority to enforce the KCDPA — there is no private right of action.",
            "verbatimQuote": "The Attorney General shall have exclusive authority to enforce violations of KRS 367.3611 to 367.3629.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/kentucky#src-stat-3627-enforce"
          },
          {
            "id": "stat-3627-cure",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "KRS 367.3627",
            "citation": "KRS 367.3627(2).",
            "url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55844",
            "proposition": "Before bringing an action, the Attorney General must give a controller or processor 30 days' written notice identifying the specific provisions allegedly violated.",
            "verbatimQuote": "the Attorney General shall provide a controller or processor thirty (30) days' written notice identifying the specific provisions of KRS 367.3611 to 367.3629, the Attorney General alleges have been or are being violated.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/kentucky#src-stat-3627-cure"
          },
          {
            "id": "stat-3627-no-pra",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "KRS 367.3627",
            "citation": "KRS 367.3627(4).",
            "url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55844",
            "proposition": "The KCDPA does not provide a private right of action for violations.",
            "verbatimQuote": "Nothing in KRS 367.3611 to 367.3629 or any other law, regulation, or the equivalent shall be construed as providing the basis for, or give rise to, a private right of action for violations of KRS 367.3611 to 367.3629.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/kentucky#src-stat-3627-no-pra"
          }
        ]
      }
    ]
  }
}