DPO SchoolDPO School

Kentucky Consumer Data Protection Act

Kentucky privacy law (KCDPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may confirm and access their data, correct it, delete it, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and significant-effect profiling. Controllers must answer within 45 days, extendable once by 45 days with notice, and responses are free up to twice a year. Appeals must be decided in writing within 60 days, with a route to complain to the Attorney General if denied.

Key points

  1. Rights: confirm and access, correct, delete, portable copy of data the consumer provided, and opt out of targeted advertising, sale and significant-effect profiling.

    Section: KRS 367.3615(2)

  2. Response within 45 days of receipt; one extension of 45 days if the consumer is told within the first period, with reasons.

    Section: KRS 367.3615(3)(a)

  3. Responses are free up to twice a year per consumer; excessive, repetitive, technically infeasible or manifestly unfounded requests may be charged or refused.

    Section: KRS 367.3615(3)(c)

  4. Appeal process required; written decision within 60 days, with a way to complain to the Attorney General if the appeal is denied.

    Section: KRS 367.3615(4)

  5. A parent or legal guardian may exercise rights for a child.

    Section: KRS 367.3615(1)

  6. Contract terms that waive or limit these rights are void.

    Section: KRS 367.3617(2)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Kentucky statute

Reference material, not legal advice.