Kentucky Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Under KRS 365.732, Kentucky businesses that own or license computerized personal information must notify affected residents after a breach involving unencrypted data, but only when the breach is reasonably likely to cause identity theft or fraud. Notification must occur without unreasonable delay. Encrypted data is exempt.

If your business handles personal data belonging to Kentucky residents, you need to understand the state's data breach notification rules. A single breach affecting thousands of people can trigger notification obligations that carry legal consequences for businesses that fail to act promptly.

Kentucky's breach notification framework operates through two separate statutes: one for private-sector entities and one for government agencies. Both require notification without unreasonable delay, but the government rules impose stricter requirements, including mandatory reporting to multiple state agencies.

For an overview of Kentucky's broader privacy framework, see the parent guide to Kentucky Data Privacy Laws.

Who Must Comply With KRS 365.732

Kentucky's primary data breach notification law, KRS 365.732, applies to any person or business entity that conducts business in Kentucky and owns or licenses computerized data that includes personal information.

The statute covers a broad range of entities. If you maintain computerized records containing personal information about Kentucky residents, regardless of where your business is physically located, KRS 365.732 applies to you.

There are two key exemptions. Entities regulated under the Health Insurance Portability and Accountability Act (HIPAA) are exempt, as are financial institutions subject to the Gramm-Leach-Bliley Act (GLBA). These entities follow their own federal breach notification frameworks instead.

State agencies and local governments are also excluded from KRS 365.732 because they are covered under the separate government breach notification statutes at KRS 61.931 through 61.934.

What Qualifies as Personal Information

Under KRS 365.732, personal information means an individual's first name or first initial and last name in combination with one or more of these data elements:

• Social Security number
• Driver's license number
• Account number, credit card number, or debit card number combined with any required security code, access code, or password that would permit access to the account

The data must be in computerized (electronic) form. Paper records are not covered by this statute.

What Triggers a Notification Obligation

A breach occurs when there is an unauthorized acquisition of unencrypted and unredacted computerized data that compromises the security, confidentiality, or integrity of personal information.

Kentucky adds an important qualifier. Notification is required only when the breach actually causes, or the entity reasonably believes it has caused or will cause, identity theft or fraud against the affected residents. If the entity determines through its investigation that no harm is reasonably likely, notification is not required.

This risk-of-harm threshold gives businesses some discretion. However, that discretion comes with responsibility. If a business incorrectly assesses the risk and does not notify, it could face legal exposure.

Good faith exception. The law provides that acquisition of personal information by an employee or agent of the entity does not constitute a breach, as long as the information is not actually misused or further disclosed without authorization.

Encryption Safe Harbor

Kentucky's statute does not apply to information that is encrypted or redacted. This is a straightforward safe harbor: if you encrypt personal information and a breach occurs, you are not required to send notifications under KRS 365.732.

This incentivizes businesses to adopt encryption as a standard data protection practice. If your organization stores personal information electronically, encryption removes one of the most significant legal risks associated with a breach.

Notification Timing and Method

When notification is required, businesses must act in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Kentucky does not set a specific deadline in days. The "without unreasonable delay" standard gives businesses time to investigate, but it also means that unnecessary foot-dragging could be considered a violation.

Law enforcement delay. If a law enforcement agency determines that notification would impede a criminal investigation, the business may delay notification until law enforcement authorizes it.

Methods of Notice

Businesses may provide notice through:

• Written notice sent to the affected individual's last known address
• Electronic notice consistent with the federal Electronic Signatures in Global and National Commerce Act (E-SIGN Act)

Substitute Notice

If direct notification would cost more than $250,000, affect more than 500,000 people, or the entity lacks sufficient contact information, substitute notice is available. Substitute notice requires all three of the following:

• Email notification to all affected individuals for whom the entity has an email address
• Conspicuous posting on the entity's website
• Notification to major statewide media outlets

Credit Reporting Agency Notification

When a breach affects more than 1,000 Kentucky residents, the entity must also notify all nationwide consumer reporting agencies and credit bureaus without unreasonable delay. This notification must describe the timing, distribution, and content of the notices sent to affected individuals.

Third-Party Data Holders

If an entity maintains personal information on behalf of another business (the data owner or licensee), the maintaining entity must notify the data owner or licensee of the breach as soon as reasonably practicable after discovering it. The data owner or licensee then becomes responsible for notifying affected individuals.

Government Entity Requirements (KRS 61.931 Through 61.934)

Kentucky holds government agencies to a different and more detailed standard through KRS 61.931 through 61.934, effective January 1, 2015.

Broader Definition of Personal Information

The government statutes define personal information more broadly than the private-sector law. Under KRS 61.931, personal information includes an individual's first name or first initial and last name, personal mark, or unique biometric or genetic print or image, in combination with:

• Social Security number
• Taxpayer identification number that incorporates a Social Security number
• Driver's license number or state identification card number
• Account number, credit card number, or debit card number with required security codes or passwords
• Other individual identification number

This definition is broader than KRS 365.732 in two ways: it includes biometric and genetic identifiers as qualifying name elements, and it adds taxpayer identification numbers as a covered data element.

Mandatory Multi-Agency Notification

Government agency notification under KRS 61.933 happens in stages, not as one flat list of recipients.

Within 72 hours of determining that a breach occurred, the agency must notify the Attorney General, the Auditor of Public Accounts, and the Kentucky State Police, plus one branch-specific recipient depending on the type of agency: the Finance and Administration Cabinet secretary for executive branch units, the Department for Local Government commissioner for county or city governments, the Kentucky Department of Education commissioner for school districts, or the Council on Postsecondary Education president for public colleges and universities.

Within 48 hours of completing its investigation, the agency must notify those same officials again, plus the commissioner of the Department for Libraries and Archives.

Within 35 days of that 48-hour notification, the agency must notify the individuals affected by the breach.

If more than 1,000 individuals will be notified, the agency must also notify the Commonwealth Office of Technology, or the applicable departmental equivalent, along with nationwide consumer reporting agencies, at least 7 days before notifying individuals.

This staged, branch-specific notification requirement reflects the heightened accountability expected of government entities handling citizen data.

Third-Party Contractor Obligations

Private companies that contract with Kentucky state agencies and handle personal information face specific obligations under KRS 61.932.

For contracts executed or amended on or after January 1, 2015, contractors must implement security and breach investigation procedures at least as stringent as those required of the government agency itself.

When a contractor discovers a breach, it must notify the contracting agency in the most expedient time possible and without unreasonable delay, but no later than 72 hours after determining the breach occurred. The contracting agency then takes responsibility for notifying affected individuals and the Attorney General.

AG-Approved Delays

If a government agency determines that measures necessary to restore the integrity of its data system cannot be implemented within the required notification timeframe, the agency may request a delay. That delay must be approved in writing by the Office of the Attorney General.

Injunctive Relief

Under KRS 61.933, the Attorney General may seek injunctive relief against entities that fail to comply with government breach notification requirements.

Enforcement and Penalties

Private Sector (KRS 365.732)

KRS 365.732 does not contain specified penalties or a dedicated enforcement mechanism. The statute also does not create an explicit private right of action.

However, injured parties may have recourse through KRS 446.070, Kentucky's general remedy statute. KRS 446.070 provides that a person injured by the violation of any statute may recover damages from the offender through a civil action. This creates a potential, though untested in many data breach contexts, pathway for affected individuals to seek damages.

The Attorney General may also pursue enforcement through Kentucky's general consumer protection statutes.

Government Entities (KRS 61.931 Through 61.934)

The Attorney General has explicit authority to seek injunctive relief against government entities and their contractors that violate the breach notification requirements. This gives the AG power to compel compliance through court orders.

The KCDPA's Impact on Data Breach Response

The Kentucky Consumer Data Protection Act (KCDPA), which took effect on January 1, 2026, does not replace the existing breach notification statutes. However, it adds a new layer of data protection obligations that affect how businesses handle personal information before, during, and after a breach.

Under the KCDPA, codified at KRS 367.3611 through 367.3629, businesses that meet the applicability thresholds must:

• Implement reasonable data security practices proportional to the volume and sensitivity of the data they process
• Classify biometric data, genetic data, precise geolocation data, and other sensitive categories as requiring opt-in consent
• Respond to consumer deletion and access requests within 45 days
• Conduct data protection assessments for high-risk processing activities

The KCDPA gives the Attorney General exclusive enforcement authority with penalties of up to $7,500 per violation after a 30-day cure period. While the KCDPA does not directly modify KRS 365.732, a data breach that results from inadequate security practices could trigger enforcement actions under both frameworks.

The Kentucky Attorney General's Office of Data Privacy, created to enforce the KCDPA, can be reached at (502) 892-8538.

Insurance Data Security Law

Kentucky also enacted an insurance-specific data security law at KRS 304.3-750 through 304.3-768. Under KRS 304.3-760(1), licensed insurers, agents, and other insurance entities must notify the Commissioner of Insurance of a cybersecurity event as promptly as possible, but in no event later than three business days from a determination that a cybersecurity event has occurred. Three independent triggers can start that clock. An insurer domiciled in Kentucky must notify the Commissioner whenever an event is reasonably likely to harm any material part of its normal operations, regardless of how many residents are affected (KRS 304.3-760(1)(a)). A producer whose home state is Kentucky must notify the Commissioner whenever a cybersecurity event occurs, with no harm or consumer-count qualifier (KRS 304.3-760(1)(b)). And any licensee, whether or not it is domiciled in Kentucky, must notify the Commissioner when it reasonably believes the event involves 250 or more consumers residing in Kentucky and the event either requires notice to a governmental body, self-regulatory agency, or other supervisory body under state or federal law or is reasonably likely to materially harm a Kentucky consumer or a material part of the licensee's normal operations (KRS 304.3-760(1)(c)).

Penalties under the insurance data security law can reach $10,000 per violation for insurers and $1,000 to $2,000 for individual agents and adjusters.

Steps to Take After a Breach in Kentucky

If your business experiences a data breach involving Kentucky residents' personal information, consider these steps:

1. Contain the breach and secure your systems to prevent further unauthorized access
2. Investigate the scope to determine what data was compromised and how many individuals are affected
3. Assess the risk of harm to determine whether the breach is reasonably likely to cause identity theft or fraud
4. Notify affected individuals in the most expedient time possible if harm is likely
5. Notify credit reporting agencies if more than 1,000 Kentucky residents are affected
6. Document your response including the investigation findings and notification timeline
7. Contact law enforcement if the breach involves criminal activity

If you are a government contractor, remember the 72-hour notification window to the contracting agency.

Sources and References

This article references Kentucky statutes and official state government publications. For the full text of the breach notification statutes, visit the Kentucky Legislature website. For consumer guidance on data breaches and identity theft, visit the Kentucky Attorney General website. For information about the KCDPA and the Office of Data Privacy, see the AG's KCDPA page.

This article provides general legal information about Kentucky data breach notification laws. It is not legal advice. Consult a qualified attorney for guidance on your specific situation. Laws and regulations change frequently. Verify current requirements through official Kentucky government sources.

More Kentucky Laws

• Kentucky Deepfake Laws
• Kentucky Employee Monitoring Laws
• Kentucky GPS Tracking Laws
• Kentucky Recording Laws

Frequently Asked Questions

How quickly must a business notify Kentucky residents of a data breach?

Kentucky law requires notification in the most expedient time possible and without unreasonable delay. The state does not set a specific deadline in days. The timeline must account for any measures necessary to determine the scope of the breach and restore the integrity of the data system. Notification may also be delayed if law enforcement determines it would impede a criminal investigation.

Does Kentucky require businesses to notify the Attorney General after a data breach?

No. The private-sector breach notification law (KRS 365.732) does not require businesses to notify the Attorney General. However, government agencies must notify the AG, along with the Auditor of Public Accounts, Kentucky State Police, and other state entities, under KRS 61.933. Businesses may still face AG scrutiny through consumer protection enforcement.

What is Kentucky's encryption safe harbor for data breaches?

Kentucky's breach notification law does not apply to information that was encrypted or redacted at the time of the breach. If you encrypt personal information and an unauthorized party gains access, you are not required to send breach notifications under KRS 365.732. This safe harbor provides a strong incentive for businesses to encrypt stored personal data.

Can individuals sue for damages after a data breach in Kentucky?

KRS 365.732 does not create an explicit private right of action. However, individuals may seek damages under KRS 446.070, Kentucky's general remedy statute, which allows a person injured by any statutory violation to recover damages. The Kentucky Consumer Data Protection Act (KCDPA) also does not provide a private right of action. The Attorney General has exclusive enforcement authority under the KCDPA.

How does the Kentucky Consumer Data Protection Act affect data breach obligations?

The KCDPA, effective January 1, 2026, does not replace the existing breach notification statutes. It adds obligations for businesses to implement reasonable data security practices, obtain consent before processing sensitive data like biometric identifiers, and respond to consumer rights requests. A breach resulting from inadequate security could trigger enforcement under both the KCDPA (up to $7,500 per violation) and the existing breach notification law. The Attorney General's Office of Data Privacy enforces the KCDPA.