KENTUCKY CONSUMER DATA PROTECTION ACT
- Section 367.3611 - Definitions for KRS 367.3611 to 367.3629 [Effective 1/1/2026]
- Section 367.3613 - Application - Limitations - Information and data exemptions - Compliance with federal children's online privacy laws [Effective 1/1/2026]
- Section 367.3615 - Consumer rights request - Controller compliance - Requirements - Appeal process [Effective 1/1/2026]
- Section 367.3617 - Limitations on the collection and use of personal data by a controller - Waiver of consumer rights contrary to public policy - Privacy notice - Notice for sale of personal data to third party - Process for consumers to exercise consumer rights requirement [Effective 1/1/2026]
- Section 367.3619 - Data processing responsibilities to controller - Contract requirements between controller and processor [Effective 1/1/2026]
- Section 367.3621 - Data protection impact assessment - Requirements - Disclosure to Attorney General - Confidentiality and exceptions - Application [Effective 1/1/2026]
- Section 367.3623 - De-identifiable data requirements - Construction - Limitation of consumer rights on pseudonymous data - Controller oversight of de- identifiable or pseudonymous data [Effective 1/1/2026]
- Section 367.3625 - Construction of KRS 367.3611 to 367.3629 - Uses of data by controller or processor - Application of evidentiary privilege - Disclosure of data to third- party controller - Limitations on processing of personal data - Burden of proof [Effective 1/1/2026]
- Section 367.3627 - Enforcement authority of Attorney General - Written notice of violation - Civil action - Damages - Recovery of expenses [Effective 1/1/2026]
- Section 367.3629 - Consumer privacy fund [Effective 1/1/2026]