Privacy law coverage affecting Kentucky: enforcement actions, legislation, court decisions and compliance deadlines, reported from primary sources.
Kentucky has a comprehensive consumer privacy statute, the Kentucky Consumer Data Protection Act (KCDPA). This page collects our coverage touching Kentucky, alongside the federal rules that apply there. For the statute itself rather than the news, see our Kentucky privacy law page.
Kentucky's privacy statute, House Bill 15 of 2024, took effect January 1, 2026 at KRS 367.3611 to 367.3629. A 2025 act widened its health-data exemptions before it ever applied, its 30-day cure has no expiry, penalties flow to a dedicated fund, and the Attorney General invoked it eight days after it began.
Read more →Kentucky's private-sector breach statute was created by House Bill 232 in 2014 and has not been amended since. It counts an incident as a breach only if it causes or is reasonably believed to cause identity theft or fraud, requires no notice to any state office, and contains no enforcement clause of its own.
Read more →House Bill 5 of 2014 gave Kentucky's executive branch, local governments, school districts and public universities, and the contractors that receive their data, a security duty and a staged reporting chain: officials within 72 hours, again within 48 hours of the investigation's end, then affected individuals within 35 days.
Read more →