Governance, risk & compliance

Kentucky Consumer Data Protection Act (KCDPA) KRS 367.3611 to 367.3629; in force 1 Jan 2026 (2024 Ky. Acts ch. 72)

The Kentucky Consumer Data Protection Act is KRS 367.

3611 to 367. 3629 (2024 Ky.

Acts ch. 72, HB 15), in force from 1 January 2026.

It applies to businesses in Kentucky or targeting Kentucky residents that handle the personal data of 100,000 or more consumers a year, or 25,000 or more while earning over half of revenue from selling personal data. Nonprofits, higher education, government, financial institutions and HIPAA entities are exempt.

Consumers can confirm and access, correct, delete and copy their data, and opt out of targeted advertising, sale and profiling. Responses are due in 45 days (extendable by 45) and appeals in 60 days.

Sensitive data needs consent, and known child data follows COPPA. Controllers must minimize data, limit secondary use, keep reasonable security, give a privacy notice and offer request methods.

Processors need a binding contract. Data protection impact assessments apply to processing created or generated on or after 1 June 2026.

The Attorney General enforces alone: a 30-day cure with no sunset, then up to $7,500 per continued violation. There is no private right of action and no universal opt-out mandate in the text read.

A 2026 amendment (2026 Ky. Acts ch.

118, HB 692) adds consent for automatic content recognition data from 1 July 2027. Read from the Act PDF and the KRS statute pages.

KRS 367. 3621 was matched by the Act’s section order and its cross-reference in 367.

3619. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Kentucky Consumer Data Protection Act (KCDPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Kentucky Consumer Data Protection Act (KCDPA) compliance

Most of Kentucky Consumer Data Protection Act (KCDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Kentucky Consumer Data Protection Act (KCDPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Kentucky Consumer Data Protection Act (KCDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Kentucky Consumer Data Protection Act (KCDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.