Blog

Kentucky Consumer Privacy Act joins US privacy landscape

The state follows New Jersey and New Hampshire in passing comprehensive privacy legislation in 2024

Alexis Kateifides
Director, Regulatory Intelligence
April 8, 2024

Who does the Act apply to?
What are the key requirements?
Next steps and how to prepare

On April 4, 2024, the Kentucky Consumer Privacy Act (KCPA) was signed into law by the Governor of Kentucky. The law becomes the third passed in the United States in 2024 following New Jersey and New Hampshire and will take effect on January 1, 2026.

The KCPA will introduce the requirement for Data Protection Impact Assessments (DPIAs) for certain processing activities as well as a range of consumer rights, and opt-in consent for processing sensitive data, among other things. Continue reading this blog to learn more about some of the key requirements of the KCPA.

Who does the Kentucky Consumer Privacy Act (KCPA) apply to?

The KCPA will apply to businesses that operate in Kentucky or that produce products or services that are targeted to residents of Kentucky. For the KCPA to be applicable, businesses must also meet an application threshold where, during a calendar year, they control or process personal data of at least:

100,000 consumers

25,000 consumers and derive over 50% of gross revenue from the sale of personal data

There are a range of organizational exemptions to the KCPA which must be considered. The law will not apply to entities including, but not limited to:

City, state agency or any political subdivision of Kentucky
Financial institutions, their affiliates, or data subject to the Gramm-Leach-Bliley Act (GLBA)
Covered entities or business associates pursuant to the Health Insurance Portability and Accountability Act (HIPAA)

Non-profit organizations
Institutions of higher education

What are the key requirements of the KCPA?

The KCPA mirrors many requirements found across existing state privacy laws in the US. The law includes a range of consumer rights, conditions for valid consent including opt-in consent for sensitive data, and rules for performing DPIAs.

Consumer rights

As with most modern privacy laws, the KCPA offers consumers a wide range of rights to exercise in relation to their personal information. In the case of a child, a parent or guardian can exercise these rights on their behalf.

The rights outlined by the KCPA include:

The right to confirm processing
The right to access
The right to correction
The right to deletion
The right to data portability
The right to opt out of:
- The sale of personal data
- Profiling
- Targeted advertising

Organizations will have 45 days to respond to a consumer rights request with the possibility of a 45-day extension where reasonable. Organizations will also have 45 days to inform consumers of a declined request as well as the justification for declining the request.

Consent

Under the KCPA, consent is defined as “a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.” This can be given via a written statement, electronic means, or another unambiguous affirmative action.

Furthermore, processing sensitive data – which includes, but not limited to, information relating to racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status – operates on an opt-in basis, meaning that organizations must obtain consent from the individual prior to processing.

Privacy notices

Organizations will be required to provide consumers with “a reasonably accessible, clear, and meaningful privacy notice”. Such disclosures should include information describing:

The categories of personal data
The purpose for processing
How consumers can exercise their rights
How a consumer can appeal an organization’s decision to refuse a consumer rights request
The categories of personal data shared with third parties
The categories of third parties

Data Protection Impact Assessments

Under the KCPA, organizations will be required to conduct and document DPIAs for specific processing activities. These include:

Processing for targeted advertising
The sale of personal data
Processing for profiling, where the profiling presents a reasonably foreseeable risk of:
- Unfair or deceptive treatment of consumers
- Financial, physical, or reputational injury to consumers
- Intrusions on the private affairs or concerns of consumers
Processing sensitive data
Processing that presents a heightened risk of harm to consumers

Like other US state privacy laws, a DPIA under the KCPA should identify and weigh the benefits of the processing against the potential risks to the consumer. Additionally, a single Data Protection Impact Assessment (DPIA) can fulfill this requirement for a group of similar processing activities. This is true if these activities include comparable assessments conducted in accordance with other laws and if those assessments have a scope and effect that are reasonably equivalent. The data protection assessment requirement will only apply to processing activities created on or after June 1, 2026.

Enforcement and penalties

The Kentucky Attorney General will have the sole authority to enforce violations of the KCPA and will provide organizations a 30-day cure period to remedy violations of the law. Failure to remedy violations within 30 days can result in monetary penalties of up to $7,500 per violation. Money accrued via such penalties will be deposited into a Consumer Privacy Fund. There is no private right of action.

Next steps and how to prepare for the KCPA

The Kentucky Consumer Privacy Act will take effect on January 1, 2026, giving organizations a little under two years to prepare for its requirements. Ensuring your consumer rights request processes and privacy notices align with the obligations of the KCPA will be a good starting place for organizations needing to comply with the law. Furthermore, ensuring your data protection assessment processes match the KCPA’s requirements ahead of June 1, 2026 can be seen as a best practice although not an immediate priority.

Learn more about how the OneTrust Privacy & Data Governance cloud can help you to get your privacy program up to speed with the KCPA.

Your partner in trust transformation

Resources

Platform

Company

Latest News

Contact Us

Privacy Matters

Our privacy center makes it easy to see how
we collect and use your information.

Your privacy

When we collect your personal information, we always inform you of your rights and make it easy for you to exercise them. Where possible, we also let you manage your preferences about how much information you choose to share with us, or our partners.

Blog

Kentucky Consumer Privacy Act joins US privacy landscape

Table of contents

Who does the Kentucky Consumer Privacy Act (KCPA) apply to?

What are the key requirements of the KCPA?

Consumer rights

Consent

Privacy notices

Data Protection Impact Assessments

Enforcement and penalties

Next steps and how to prepare for the KCPA

You may also like

Privacy Management

From legislation to operation: How to prepare for the new wave of US Privacy laws

Prepare your organization for the new wave of US privacy laws.

June 06, 2024

Privacy Management

Federal US privacy bill on the horizon? Exploring the draft APRA & new state privacy legislation

Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.

April 23, 2024

Privacy Management

US state privacy laws timeline

View our timeline to understand the progression of current US state privacy laws and key dates.

April 23, 2024

Privacy Management

Spring into action! Navigating CPRA: Ensuring compliance and protecting privacy

Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.

March 21, 2024

Privacy Management

The road to 50 states: New Jersey and New Hampshire join the US privacy landscape

oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.

February 01, 2024

Privacy Automation

Embedding Privacy by Design through PIA Automation

Join us for a webinar on Embedding Privacy by Design through PIA Automation.

January 11, 2024

Privacy Management

Automating fulfillment of subject rights requests in the US

Learn how Privacy Rights Automation helps to fully automate privacy rights requests.

December 06, 2023

Privacy Management

December's deadline: Ensuring compliance with Utah's privacy regulation

Join us for a webinar as we explore the impending implementation of the Utah Privacy Law, set to take effect on December 31, 2023.

November 14, 2023

Privacy Management

The road to privacy compliance: A spotlight on Oregon & Delaware legislation

We explore the new Oregon and Delaware privacy laws, how they differ from other US privacy laws, and what they mean for your business.

September 14, 2023

Privacy Management

Utah Consumer Privacy Act law book

Download the Utah Consumer Privacy Act law book and have the official UCPA text at your fingertips for when the law takes effect on December 31, 2023.

September 04, 2023

Privacy Management

The road to 50 states: Delaware and Oregon join the US privacy landscape

Get in-depth analysis on two upcoming US Privacy laws, the Oregon Consumer Privacy Act (OCPA) and the Delaware Personal Data Privacy Act (DPDPA), with OneTrust DataGuidence and a panel of experts.

August 10, 2023

Privacy Management

EU-US Data Privacy Framework resource kit

Download our EU-US Data Privacy Framework resource kit to better understand the new aggreement for cross-border personal data transfers and how to educate your stakeholders.

July 20, 2023

Privacy & Data Governance

US privacy resource kit

Download our US privacy resource kit designed to access a range of materials to help you understand how the US privacy landscape is evolving.

July 13, 2023

Privacy Management

Now in effect: Colorado and Connecticut privacy laws

In this free webinar, our privacy experts delve into the new Colorado and Connecticut privacy laws and how they differ from other US state regulations.

July 12, 2023

Privacy Management

New states, new dates: Preparing for Indiana, Montana, Tennessee and Florida state privacy laws

Join our expert panel where we examine upcoming privacy legislation in Indiana, Montana, Tennessee, and Florida and the key requirements of each law.

June 20, 2023

Consent & Preferences

Navigating Google's new CMP requirements

Adapt to Google's June 2023 CMP requirements with this infographic and confidently engage your audience while staying compliant.

June 20, 2023

Privacy Automation

US privacy laws on the horizon: Which states will be next?

Join our live webinar as OneTrust DataGuidence and privacy experts examine new privacy legislation in Indiana, Montana, Tennessee, Florida, and Texas.

June 15, 2023