Kentucky. Breach notification. Act
KY breach lawKentucky data breach notification law (Ky. Rev. Stat. § 365.732 (private); §§ 61.931-.934 (public agencies))
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Kentucky residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence, financial account or card numbers with codes.
- Key themes
- Unique features
Breach requires actual or reasonably believed identity theft or fraud; public-agency contractors must notify the agency within 72 hours.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Kentucky requires the maintaining entity to notify the owner as soon as reasonably practicable; contractors of state agencies have 72 hours. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; no private-sector AG notice; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Not specified
§3Dates
- Key dates
- Adopted
- In force
- HB 232 (2014) enacted private-sector law; HB 5 (2014, eff. 2015-01-01) covers public agencies
§4Text and authority
- Text
- Authoritative text apps.legislature.ky.gov
- Authority
- Kentucky Attorney General
§5Where it applies
- Domestic law of
- Kentucky
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.