Kentucky Consumer Data Protection Act (KCDPA) Assessment

KCDPA applies to persons that conduct business in Kentucky or produce products or services targeted to Kentucky residents.

Under KCDPA, a “consumer” is a Kentucky resident acting only in an individual context. It does not include a person acting in a commercial or employment context.

The KCDPA applies to you if you, in a calendar year, either control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.

KCDPA does not apply to certain entities, including Kentucky state or local bodies, financial institutions and affiliates regulated under the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, institutions of higher education, certain insurance-related entities, and some telecom or municipal utilities.

KCDPA excludes several categories of data, including HIPAA-related data, health records, Fair Credit Reporting Act (FCRA) data, Family Educational Rights and Privacy Act (FERPA) data, Driver's Privacy Protection Act (DPPA) data, certain research and public health data, and employment-related data.

A controller determines the purposes and means of processing personal data. A processor processes personal data on behalf of a controller. KCDPA distinguishes between these roles.

KCDPA grants consumers rights such as access, correction, deletion, portability, and opt-out rights. Controllers generally must respond within 45 days, with one possible 45-day extension when reasonably necessary.

KCDPA requires controllers to provide a reasonably accessible, clear, and meaningful privacy notice covering the categories of personal data collected, purposes, how rights are exercised including appeals, the categories of third parties receiving sold data if any, the categories of personal data shared with third parties, clear opt-out information if data is sold or is used for targeted advertisements, and description of secure method(s) to submit consumer requests.

KCDPA requires opt-out rights for sale, targeted advertising, and certain profiling, and requires consent for processing sensitive data, with Children's Online Privacy Protection Act (COPPA)-aligned handling for known children.

KCDPA requires processor contracts to address instructions, nature and purpose of processing, type of data, duration, confidentiality, deletion or return, and related compliance support.

KCDPA requires controllers to establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data.