Kentucky's Public Agency Breach Law: KRS 61.931 to 61.934 and the 72-Hour Reporting Chain

Which Agencies and Contractors KRS 61.931 to 61.934 Reach

The four sections were enacted as 2014 Ky. Acts ch. 74, House Bill 5, "AN ACT relating to the safety and security of personal information held by public agencies." The bill record lists D. Butler and S. Santoro first among a long sponsor list and shows the governor's signature. The act was signed on April 10, 2014, the same day as the private-sector statute (see the post on KRS 365.732), and took effect January 1, 2015. Its sections 5 to 9 amended KRS 42.722, 42.726, 42.732, 171.450 and 171.680, and section 10 provides that the act does not affect the open records provisions at KRS 61.870 to 61.884.

KRS 61.931(1) defines "agency" in five paragraphs:

1. the executive branch of state government;
2. every county, city, municipal corporation, urban-county, charter county, consolidated local and unified local government;
3. every unit, board, commission, authority, instrumentality or public corporation of, or created or controlled by, those bodies;
4. every public school district; and
5. every public institution of postsecondary education, including the Kentucky Community and Technical College System.

The legislative and judicial branches are not in that list. KRS 61.934 instead requires them to keep security and breach investigation procedures "consistent with" the four sections, and directs the Department for Libraries and Archives to set disposal procedures for records containing personal information. A "nonaffiliated third party" is any person that has a contract or agreement with an agency and receives personal information from it under that agreement.

Personal Information and Security Breach, as Defined

The identifying half of "personal information" is broader than a name. It is a first name or initial and last name, a "personal mark," or a "unique biometric or genetic print or image," combined with any of six elements: a financial account or card number with its access code; a Social Security number; a taxpayer identification number that incorporates one; a driver's license, state ID or other agency-issued identification number; a passport or other federal identification number; or individually identifiable health information as defined in 45 C.F.R. § 160.103, excluding records covered by FERPA.

A "security breach" is not limited to acquisition. It is the unauthorized "acquisition, distribution, disclosure, destruction, manipulation, or release" of unencrypted or unredacted records, or of encrypted records along with the key, that compromises or that the agency or contractor reasonably believes may compromise personal information "and result in the likelihood of harm to one (1) or more individuals." Encryption means meeting or exceeding the level NIST has adopted in the Federal Information Processing Standards and rendering data indecipherable without the key.

Security Procedures and Practices

KRS 61.932(1)(a) requires an agency or contractor holding personal information "regardless of the form in which the personal information is maintained" to implement, maintain and update security procedures and practices, including corrective action. Each kind of agency answers to a different policy source:

For agreements executed or amended on or after January 1, 2015, an agency that discloses personal information to a contractor must require procedures "at least as stringent" as its own. The contractor must notify the agency "within seventy-two (72) hours of determination of a security breach," with all the information it then has, and the agreement must say how notification and investigation costs are apportioned. A contractor already required by federal law to investigate or notify may meet the Kentucky duties by giving the agency copies of those federal reports, unless the breach includes listed data elements that federal law does not cover.

The Agency Notice Chain

KRS 61.933(1) builds the reporting in stages, each with its own clock:

If the investigation finds that misuse "has not occurred and is not likely to occur," no individual notice is required, but the agency keeps records of the basis for its decision for a period the State Archives and Records Commission sets, and tells the officers that misuse has not occurred.

Reports go on forms set by the Commonwealth Office of Technology. 200 KAR 1:016, effective January 3, 2023, incorporates Finance Form FAC-001, the Suspected and Determined Breach Notification Form, and FAC-002, a Delay Notification Record used when notice is delayed at a law enforcement agency's request or with the Attorney General's approval.

Notice to Individuals

Individual notice under KRS 61.933(2) has three parts, all required: a conspicuous posting on the agency's website; notice to regional or local media for a localized breach and also to major statewide media, including radio and television, for a widespread one; and personal communication by mail, email or telephone, whichever the agency believes most likely to reach the person. Email is unavailable to someone who has told the agency in writing they do not want it.

The notice must be "clear and conspicuous" and describe the categories and elements of information involved, give the agency's contact details, describe the agency's general protective steps "excluding disclosure of defenses," and list contact information for the credit reporting agencies, the Federal Trade Commission and the Office of the Kentucky Attorney General as sources on avoiding identity theft.

Under subsection (3), notices are withheld on a law enforcement agency's written request and sent once it confirms in writing that the investigation is complete or will not be impeded. Individual notice may also be delayed past 35 days while the data system's integrity is restored, but only with the Attorney General's written approval. Subsection (4) voids any waiver, and subsection (5) excludes redacted information, information disclosed to government bodies for their statutory duties, public-record information, information the individual consented to publish, and documents recorded with county or circuit clerks or a federal district court.

Enforcement and Reporting

Under KRS 61.933(6), the Attorney General "may bring an action in the Franklin Circuit Court against an agency or a nonaffiliated third party that is not an agency, or both, for injunctive relief, and for other legal remedies against a nonaffiliated third party that is not an agency." Agencies therefore face injunctions only. The same subsection states that nothing in the four sections creates a private right of action.

No Franklin Circuit Court action under subsection (6) was located for this post, and the enforcement record here is zero. The statute's reporting trail runs through the legislature instead. KRS 42.726(5) requires the Commonwealth Office of Technology to report to the Legislative Research Commission by October 1 each year on executive-branch breaches requiring notice to the office during the prior fiscal year, the actions taken, and any quantifiable financial impact.

On October 14, 2026, the office's deputy chief information officer presented the statute to the Information Technology Oversight Committee. The slides list the Office of Technology as a fourth recipient "for all breaches," marked with an asterisk the slides do not explain. As codified, KRS 61.933(1)(a) names the State Police, the Auditor and the Attorney General plus one officer by agency type, and names the Office of Technology only for executive-branch agencies giving advance notice above 1,000 individuals.

How It Differs From KRS 365.732

Frequently Asked Questions