Kentucky Privacy Compliance Checklist

Kentucky Consumer Data Protection Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

Compliance Steps

Effective: January 1, 2026 | Cure period: 30 days

Determine applicability: check whether your entity processes data of 100,000+ Kentucky consumers, or 25,000+ while deriving 50%+ of gross revenue from data sales. Check entity-level exemptions (HIPAA-covered entities, GLBA financial institutions, nonprofits, higher education, government) — these exempt the entire entity, not just specific data types

Update privacy notices with all KCDPA-required disclosures: categories of personal data processed, purposes of processing, consumer rights instructions, categories of third-party recipients, and contact information. AG Coleman identified privacy notice compliance as an early enforcement signal in the Character.AI action

Implement opt-out mechanisms for data sales, targeted advertising, and profiling. Note that "sale" under the KCDPA follows the VCDPA definition — exchange for monetary consideration — which is narrower than the CCPA's "valuable consideration" standard

Obtain opt-in consent for processing all eight sensitive data categories: racial/ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship/immigration status, genetic/biometric data for identification, precise geolocation (1,750 feet), and known children's data

Implement children's data protections: process known children's data (under 13) in compliance with COPPA, obtain verifiable parental consent, and enable parents/guardians to exercise consumer rights on behalf of children. The Character.AI enforcement demonstrates this is the AG's top enforcement priority

Create consumer rights request response system: 45-day response deadline (extendable by 45 days with notice), 10-day acknowledgment best practice, support for access, correction, deletion, portability, and opt-out requests

Establish an appeals process: controller must respond to appeals within 60 days and inform consumers of the right to file a complaint with the Kentucky Attorney General if the appeal is denied

Execute data processing agreements with all processors: require them to assist with consumer rights requests, maintain confidentiality, delete or return personal data at end of service, and allow reasonable audits. Include subcontractor flow-down provisions

Conduct data protection assessments for heightened-risk processing: targeted advertising, sale of personal data, profiling with legal or similarly significant effects, processing sensitive data, and processing children's data

Prepare for AG enforcement inquiries: establish a 30-day cure-period response protocol with designated compliance contact, document evidence of cure completion, and maintain written statement capability confirming violations were corrected. The AG may accept the cure or proceed with enforcement if the cure is inadequate

Implement data minimization practices: limit collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes. Conduct purpose limitation assessments and document data retention policies

Map multistate compliance obligations: compare Kentucky's requirements with those of similar VCDPA-model states (VA, IN, IA) and identify delta requirements — Kentucky's permanent cure period, entity-level HIPAA exemption, and narrower sale definition are key differentiators

KCDPA Compliance Checklist FAQ

What is the KCDPA compliance checklist?

It is a 12-step plan organizations use to meet the Kentucky Consumer Data Protection Act (KCDPA), which took effect January 1, 2026. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under Kentucky law.

Who has to comply with the Kentucky Consumer Data Protection Act?

The KCDPA generally applies to organizations that handle Kentucky residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for KCDPA non-compliance?

The Kentucky Attorney General — Office of Consumer Protection can impose civil penalties of up to $7,500 per violation and a 30-day cure period to fix violations before a fine. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put KCDPA Into Practice on Your SiteSponsored

Termly builds and maintains a Kentucky-ready privacy policy, a cookie consent banner, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests KCDPA grants.

Start Free with Termly

Kentucky Privacy Compliance Checklist

Compliance Steps

Key Enforcement Details

Related Resources

KCDPA Compliance Checklist FAQ

What is the KCDPA compliance checklist?

Who has to comply with the Kentucky Consumer Data Protection Act?

What is the penalty for KCDPA non-compliance?

Does this law apply to you?

Official Resources