Last updated: January 2025

Please note this is a highlighted overview and not a complete overview of privacy laws for this state. If you would like a complete review of this state's privacy laws or a multi-state privacy compliance cheat sheet on specific topics, please contact Vivien Peaden at vpeaden@bakerdonelson.com.

Disclaimer: These materials do not constitute legal advice and should not be substituted for the advice of legal counsel.

The Kentucky Consumer Data Protection Act (Kentucky CDPA)

Effective Date: January 1, 2026

1. Applicability Thresholds:

Subject to certain entity-level and data-level exemptions, the Kentucky CDPA applies to a natural or legal person conducting business in Kentucky or producing products/services that are targeted to residents of Kentucky that during a calendar year, control or process the personal data of:

• 100,000+ Kentucky consumers; or
• 25,000+ Kentucky consumers and derive more than 50 percent of revenue from the sale of personal data.

2. Key Definitions:

Sales of Personal Data: Narrowly defined as "the exchange of personal data for monetary consideration by the Controller to a third party" subject to a few exemptions.

3. Business Obligations:

The Kentucky CDPA imposes additional obligations on individuals or legal entities that determine the purpose and means of processing personal information (Controller):

• Data Processing Agreement (DPA): Processing activities by a supplier (known as Processor) shall be governed by a DPA between the Controller and Processor.
• Data Protection Impact Assessment: Controllers must conduct and document a data protection impact assessment for certain high-risk data processing activities.
• Privacy Notice: Yes, a Controller must provide consumers with a privacy notice.

4. Consumer Rights:

Subject to certain exceptions, under the Kentucky CDPA, Kentucky consumers have the right to:

• Confirm whether a Controller is processing their personal data and provide access;
• Correct inaccuracies in their personal data;
• Delete personal data provided by or obtained about the consumer;
• Obtain a copy of or summary of personal data that the consumer previously provided to the Controller in a portable and readily usable format; and
• Opt-out of targeted advertising, sales of personal data, and "profiling in furtherance of solely automated decisions that produce legal or similarly significant effects."

5. Enforcement and Penalties:

Private Right of Action: None

Penalties: The state attorney general has sole authority to enforce the statute, at a maximum of $7,500 per violation.