KCDPA Compliance Checklist: Kentucky Privacy Law

Complying with the Kentucky Consumer Data Protection Act (KCDPA), KRS 367.3611 to 367.3629, means confirming whether you are covered, posting a conforming privacy notice, getting opt-in consent before processing sensitive data, building consumer-rights and opt-out workflows, conducting data protection assessments, and signing KCDPA-compliant processor contracts. The act took effect January 1, 2026, so covered businesses are obligated now.

As of 2026, the Kentucky Attorney General enforces the KCDPA exclusively under KRS 367.3627, with a permanent 30-day cure period and civil penalties up to $7,500 for each continued violation, deposited into a consumer privacy fund. There is no private right of action, and because Kentucky's law closely mirrors Virginia's, a Virginia-ready program needs only modest tailoring.

Jurisdiction scope: This covers Kentucky's Kentucky Consumer Data Protection Act (KRS 367.3611 to 367.3629). It is general legal information, not legal advice.

Step 1: Determine whether you are covered

The first task is the applicability analysis in KRS 367.3613. The KCDPA reaches a person that conducts business in Kentucky or targets Kentucky residents and that, in a calendar year, controls or processes the personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50 percent of gross revenue from the sale of personal data.

Count only "consumers," which KRS 367.3611 defines as Kentucky residents acting in an individual context. Employee and business-to-business contacts do not count toward the threshold, so a company should scope its count to consumer-facing data.

Then run the exemption screen under KRS 367.3613(2) and (3). Entity-level exemptions cover categories such as government bodies, GLBA-covered financial institutions, HIPAA-covered entities and business associates, nonprofits (including insurance-fraud-investigation nonprofits), certain small telephone and municipal utilities, and institutions of higher education are exempt at the entity level, and specific data sets such as FCRA, FERPA, and employment data are exempt at the data level. A business can be wholly or partly outside the law, so document the analysis before building controls.

Step 2: Publish a conforming privacy notice

If you are covered, the privacy notice is the most visible obligation. KRS 367.3617(3) requires a reasonably accessible, clear, and meaningful privacy notice with specific contents.

The notice must list the categories of personal data the controller processes, the purpose for processing, and how consumers can exercise their rights under KRS 367.3615, including how to appeal a decision. It must also state the categories of personal data shared with third parties and the categories of third parties that receive the data.

There is an extra disclosure for data sales and targeted advertising. Under KRS 367.3617(4), if a controller sells personal data or processes it for targeted advertising, it must clearly and conspicuously disclose that activity and the manner in which a consumer may opt out.

Step 3: Get opt-in consent for sensitive data

Sensitive data triggers the strictest rule in the act. Under KRS 367.3617(1)(e), a controller may not process sensitive data without first obtaining the consumer's consent.

Sensitive data under KRS 367.3611 includes data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, plus genetic or biometric data used to identify a person, a known child's data, and precise geolocation data. Map where each category lives in your systems before launch.

Consent must be a clear affirmative act that is freely given, specific, informed, and unambiguous. For data collected from a known child, the controller must instead comply with the federal Children's Online Privacy Protection Act, and KRS 367.3613(4) deems COPPA-compliant parental consent sufficient for the act's parental-consent obligations.

One more consent duty is already enacted but not yet in force, so build for it now. 2026 Ky. Acts ch. 118 (House Bill 692), signed April 13, 2026, adds KRS 367.3617(1)(f), barring a controller from collecting automatic content recognition data without the consumer's consent, and adds the supporting definitions of "automatic content recognition data" and "smart monitor" to KRS 367.3611.

That covers data about a consumer's content viewing history collected through a smart television or smart monitor that identifies the specific content in real time by analyzing audio or video fingerprints, whether the content arrives by broadcast, cable, satellite, streaming, or an external input. The definition excludes interactions with content the controller itself provides, data generated in delivering a feature the consumer requested, and data collected to enforce terms of service. Section 3 of the act sets the effective date at July 1, 2027, so inventory any smart-television or smart-monitor viewing data before then and add a consent gate ahead of that date.

Step 4: Build consumer-rights and opt-out workflows

Covered controllers need an operational pipeline to handle the rights in KRS 367.3615. Consumers can confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, data sales, and profiling.

Set the clock to 45 days. KRS 367.3615(3) requires a response without undue delay and within 45 days, with one permitted 45-day extension if you notify the consumer in time. Responses are free up to twice a year per consumer, and you may charge or decline only for excessive, repetitive, technically infeasible, or manifestly unfounded requests, with the burden on you.

Stand up a conspicuous appeal process under KRS 367.3615(4) with a 60-day response window, and provide a way to reach the Attorney General if you deny an appeal. Under KRS 367.3617(5) you cannot force a consumer to create a new account to exercise rights. Note that the KCDPA does not require honoring a universal opt-out signal such as the Global Privacy Control, so your own clearly disclosed opt-out methods satisfy the act, although a multistate program may choose to honor signals voluntarily. The KCDPA consumer rights guide details the request mechanics.

Step 5: Conduct data protection assessments

The KCDPA requires documented risk assessments for higher-risk processing. KRS 367.3621(1) lists the activities that trigger a data protection impact assessment.

Those activities are targeted advertising, the sale of personal data, sensitive-data processing, profiling that presents a reasonably foreseeable risk of unfair treatment or substantial injury, and any processing that presents a heightened risk of harm. Each assessment must weigh the benefits of the processing against the risks to consumers, as mitigated by safeguards.

Timing matters: KRS 367.3621(8) provides that the assessment requirement applies to processing activities created or generated on or after June 1, 2026. The Attorney General may demand an assessment relevant to an investigation under KRS 367.3621(3), and the assessments are confidential under the open-records exemption in KRS 367.3621(4). A single assessment can cover a comparable set of similar processing operations.

Step 6: Put KCDPA processor contracts in place

If a processor handles personal data on your behalf, KRS 367.3619 requires a written contract that governs the processing. The contract must set out the processing instructions, the nature and purpose of processing, the type of data, the duration, and the rights and obligations of both parties.

The contract must also require the processor to keep personnel under a duty of confidentiality, to delete or return all personal data at the end of the services at the controller's direction, and to make available information needed to demonstrate compliance. The processor must allow reasonable assessments, or arrange an independent assessment, and must flow these obligations down to any subcontractor under a written contract.

Both sides keep their own liability. KRS 367.3619(3) provides that the contract does not relieve a controller or processor of the duties tied to its role, and whether a party is a controller or processor is a fact-based determination.

Step 7: Understand enforcement, cure, and penalties

The KCDPA is enforced only by the Attorney General. KRS 367.3627(1) gives the Attorney General exclusive authority to investigate and bring actions, and KRS 367.3627(4) makes clear there is no private right of action.

Before suing, the Attorney General must give 30 days' written notice identifying the alleged violations. If the controller or processor cures within those 30 days and provides a written statement that the violation is cured and will not recur, no damages action follows under KRS 367.3627(2). This 30-day cure period is permanent, with no sunset, which distinguishes Kentucky from states that let their cure windows expire.

If the violation is not cured, the Attorney General may seek civil penalties up to $7,500 for each continued violation under KRS 367.3627(3), plus investigation costs and fees under KRS 367.3627(5). Penalties are deposited into the consumer privacy fund created by KRS 367.3629, an Attorney-General-administered account used to fund enforcement. For the statutory background and the Virginia-clone framing, see the What is the KCDPA? guide.

Related guides

• Kentucky data privacy laws parent hub
• What is the KCDPA?
• KCDPA consumer rights
• State data privacy law comparison
• What is the CCPA?

More Kentucky Laws

• Kentucky Deepfake Laws
• Kentucky Employee Monitoring Laws
• Kentucky GPS Tracking Laws
• Kentucky Recording Laws

Frequently Asked Questions

How do I know if my business must comply with the KCDPA?

Under KRS 367.3613, you are covered if you conduct business in Kentucky or target its residents and, in a calendar year, control or process the personal data of at least 100,000 Kentucky consumers, or at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data. Count only consumers acting in an individual context, then apply the entity and data exemptions.

What must a KCDPA privacy notice include?

Under KRS 367.3617(3), the privacy notice must state the categories of personal data processed, the purposes for processing, how consumers exercise and appeal their rights, the categories of data shared with third parties, and the categories of those third parties. If you sell data or run targeted advertising, KRS 367.3617(4) requires a clear, conspicuous disclosure and an opt-out method.

Does the KCDPA require consent for sensitive data?

Yes. KRS 367.3617(1)(e) requires opt-in consent before processing sensitive data, which under KRS 367.3611 includes racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, immigration status, genetic or biometric identifiers, a known child's data, and precise geolocation. For a known child, you must follow the federal Children's Online Privacy Protection Act. A second consent duty is already on the books but not yet in force: 2026 Ky. Acts ch. 118 adds KRS 367.3617(1)(f), which from July 1, 2027 bars collecting automatic content recognition data from a smart television or smart monitor without the consumer's consent.

Does the KCDPA require honoring universal opt-out signals?

No. The KCDPA does not mandate recognition of a universal opt-out mechanism such as the Global Privacy Control. Under KRS 367.3617, you must provide and disclose your own opt-out methods for targeted advertising, data sales, and profiling, but there is no statutory duty to honor a global browser signal, matching the Virginia model Kentucky followed.

When are KCDPA data protection assessments required?

Under KRS 367.3621, you must conduct and document an assessment for targeted advertising, data sales, sensitive-data processing, high-risk profiling, and any heightened-risk processing. KRS 367.3621(8) provides that the assessment requirement applies to processing activities created or generated on or after June 1, 2026. The Attorney General may demand relevant assessments during an investigation.

What must a KCDPA processor contract include?

Under KRS 367.3619, the contract must set out processing instructions, nature and purpose, data type, and duration, and require the processor to maintain confidentiality, delete or return data at the end of services, demonstrate compliance, allow reasonable assessments, and flow the same obligations down to subcontractors by written contract.

What are the penalties for violating the KCDPA?

Under KRS 367.3627, the Attorney General can seek civil penalties up to $7,500 for each continued violation, plus investigation costs and fees, after a 30-day cure period that is permanent. Penalties go into the consumer privacy fund under KRS 367.3629. There is no private right of action, so only the Attorney General can enforce the law.

Is there a cure period under the KCDPA?

Yes, and it does not expire. Under KRS 367.3627(2), the Attorney General must give 30 days' written notice before suing, and if the business cures the violation and gives a written statement that it is cured and will not recur, no damages action follows. Unlike some states, Kentucky's 30-day cure period has no sunset date as of 2026.