Kentucky's Breach Statute, KRS 365.732: An Identity Theft Test Written Into the Definition

What KRS 365.732 Covers

The section began as House Bill 232 of the 2014 regular session, sponsored by S. Riggs, M. King and S. Westrom, whose original summary described a new section of KRS chapter 365 "to require consumer notification when a data breach reveals personally identifiable information." The governor signed it on April 10, 2014 as chapter 84 of the 2014 Acts. The same act created a second section in chapter 365 on cloud services marketed to schools. The codified text of KRS 365.732 shows an effective date of July 15, 2014 and a history line naming only the 2014 act.

Its duties fall on an "information holder," defined in one line as "any person or business entity that conducts business in this state." The definition does not mention owning or licensing data. Subsection (2) applies to every information holder, and subsection (3) separately addresses a holder that keeps data it does not own.

The definition of a breach does most of the section's work. Subsection (1)(a) requires unauthorized acquisition of "unencrypted and unredacted computerized data" that compromises personally identifiable information "maintained by the information holder as part of a database regarding multiple individuals" and that "actually causes, or leads the information holder to reasonably believe has caused or will cause, identity theft or fraud against any resident of the Commonwealth of Kentucky." An incident that does not meet the identity theft or fraud element is not a breach at all, so the statute has no separate exception for low-risk incidents. Iowa takes the opposite route, defining a breach broadly and then excusing notice through a written determination (see the post on chapter 715C).

Personally identifiable information is a first name or first initial and last name with a Social Security number, a driver's license number, or an account or card number together with the code or password permitting access to a financial account, "when the name or data element is not redacted." The section defines neither "encrypted" nor "redacted." It also uses two terms: subsection (1)(c) defines "personally identifiable information," while subsection (2) refers to residents whose "unencrypted personal information" was acquired. Because the definition speaks only of computerized data, paper records fall outside it.

The Timing Standard

No day count appears anywhere in the section. Subsection (2) requires disclosure "in the most expedient time possible and without unreasonable delay," consistent with law enforcement needs "or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system." A holder of data it does not own must tell the owner or licensee "as soon as reasonably practicable following discovery" if the information was, or is reasonably believed to have been, acquired by an unauthorized person. That subsection refers to a "breach of the security of the data," not to the defined phrase "breach of the security of the system."

Subsection (4) allows delay if a law enforcement agency determines that notice "will impede a criminal investigation," and requires notice "promptly after" the agency decides it will not. The text does not require the agency's determination to be in writing.

Under subsection (5), notice may be written, electronic if consistent with 15 U.S.C. § 7001, or substitute notice where cost would exceed $250,000, more than 500,000 people are affected, or contact information is insufficient. Substitute notice requires all three of email where available, a conspicuous website posting and notice to major statewide media. Subsection (6) treats a holder that follows its own notification procedures, if they are consistent with the section's timing, as compliant. The section prescribes no content for the notice.

The Credit Bureau Notice

Subsection (7) is the only third-party notice in the section: "If a person discovers circumstances requiring notification pursuant to this section of more than one thousand (1,000) persons at one (1) time," it must notify, without unreasonable delay, all consumer reporting agencies and credit bureaus that compile files nationwide, as defined by 15 U.S.C. § 1681a, "of the timing, distribution, and content of the notices." The subsection says "person" where the rest of the section says "information holder."

No subsection names the Attorney General or any other state office. Kentucky's public agencies, by contrast, report a breach to the Attorney General, the Auditor of Public Accounts and the Kentucky State Police within 72 hours under a separate statute enacted the same day (see the post on KRS 61.931 to 61.934).

Who Is Exempt

Subsection (8) provides that "the provisions of this section and the requirements for nonaffiliated third parties in KRS Chapter 61 shall not apply" to any person subject to Title V of the Gramm-Leach-Bliley Act or to HIPAA, "or any agency of the Commonwealth of Kentucky or any of its local governments or political subdivisions." Three features stand out in that text.

• The financial and health exemption turns on being subject to the federal law. Unlike Iowa's exemption, the text attaches no condition that the person comply with it.
• Government bodies are excluded entirely, which is why their obligations sit in KRS chapter 61 rather than here.
• The sentence reaches beyond its own section, lifting the chapter 61 contractor requirements from GLBA and HIPAA persons. KRS 61.932(1)(c)2. separately lets a contractor already bound by federal breach rules satisfy chapter 61 by handing the agency copies of its federal reports. The two provisions were signed on the same day.

Enforcement: No Remedy Clause and No Recorded Action

KRS 365.732 has no enforcement subsection. It does not name an enforcing officer, does not set a civil penalty, and neither creates nor bars a private right of action. KRS 365.990, the penalty section for chapter 365, lists penalties for sections such as 365.015, 365.100 and 365.650 to 365.695, and lists none for 365.732. This post does not address whether any other Kentucky statute supplies a remedy, because the breach section does not refer to one.

No Kentucky enforcement action citing KRS 365.732 was located for this post, and the enforcement record here is zero. The nearest item is the Attorney General's July 20, 2026 release on the 23andMe bankruptcy settlement, in which Kentucky joined 41 other attorneys general over a 2023 breach that affected 69,188 Kentucky customers. Kentucky's share of an initial $18 million payment is $259,375. The release cites no statute, including this one.

Kentuckians deserve to have their most sensitive personal data kept safe. When companies like 23andMe fail to maintain proper security practices, our Office will take action.

Attorney General Russell Coleman, 23andMe settlement release, July 20, 2026

Frequently Asked Questions