DPO SchoolDPO School

Kentucky Consumer Data Protection Act

Kentucky privacy law (KCDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act applies to persons that do business in Kentucky or target its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while earning over 50% of gross revenue from selling personal data. Government bodies, GLBA financial institutions and their affiliates, HIPAA covered entities and business associates, nonprofits and institutions of higher education are excluded at entity level. Many data types are exempt, including HIPAA, FCRA, FERPA and employment-context data.

Key points

  1. Threshold 1: personal data of 100,000 or more consumers in a calendar year.

    Section: KRS 367.3613(1)(a)

  2. Threshold 2: personal data of 25,000 or more consumers and over 50% of gross revenue from selling personal data.

    Section: KRS 367.3613(1)(b)

  3. Excluded entities: cities, state agencies and political subdivisions; financial institutions, their affiliates or data subject to GLBA Title V; HIPAA covered entities and business associates; nonprofits; institutions of higher education.

    Section: KRS 367.3613(2)(a) to (e)

  4. Also excluded: certain insurance-fraud and first-responder support organisations, small telephone utilities, Tier III CMRS providers and qualifying municipally owned utilities.

    Section: KRS 367.3613(2)(f) and (g)

  5. Data exemptions include protected health information, health records, limited data sets, FCRA, DPPA, FERPA and Farm Credit Act data, and data about job applicants, employees, agents and contractors used in that role.

    Section: KRS 367.3613(3)

  6. A consumer is a Kentucky resident acting only in an individual or household context, not in a commercial or employment context.

    Section: KRS 367.3611

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Kentucky statute

Reference material, not legal advice.