Kentucky's Consumer Data Privacy Act (KCDPA), officially titled ‘An Act relating to Consumer Data Privacy’, encapsulated within Senate Bill 15, represents a major advancement in the US State's laws protecting citizens' privacy rights.
With a rising focus on national and international consumer privacy, the KCDPA seeks to empower consumers with additional control over their personal data by exercising consumer rights. It also imposes specific obligations on businesses that collect, process, and secure consumer data.
KCDPA outlines several obligations for organizations, such as data minimization and purpose limitation, non-discrimination, security measures, consent requirements and privacy notice requirements, and conducting data protection assessments and requirements for processors, among several other requirements. It also gives data subjects rights, such as access, confirm, correct, delete, obtain a copy, and opt-out.