Kentucky. Comprehensive data protection. Act
KCDPAKentucky Consumer Data Protection Act (KRS 367.3611 et seq.)
In force
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Virginia-model law with standard rights, opt-outs, sensitive data consent and data protection assessments.
- Key themes
- Unique features
Permanent 30-day cure period; follows VCDPA closely.
- SaaS relevance
Applies at 100,000 Kentucky consumers, or 25,000 with over 50% revenue from sales.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- See KRS 365.732 (separate statute)
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- $7,500 per violation
§3Dates
- Key dates
- Adopted
- In force
- HB 692 (signed 2026-04-13) requires opt-in for smart TV automatic content recognition data, effective 2027-07-01.
§4Text and authority
- Text
- Authoritative text apps.legislature.ky.gov
- Authority
- Kentucky Attorney General
§5Where it applies
- Domestic law of
- Kentucky
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.