--- title: "Kentucky privacy law (KCDPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/kentucky/controller-duties" source: "https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Kentucky Consumer Data Protection Act # Kentucky privacy law (KCDPA): controller duties Law as of October 28, 2026 ยท [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not discriminate against consumers who use their rights. The privacy notice must list data categories, purposes, how to exercise and appeal rights, and data and third-party categories shared, and sale or targeted advertising must be disclosed with the opt-out method. Data protection impact assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing created or generated on or after 1 June 2026. The Act contains no universal opt-out signal requirement. ## Key points 1. Collection limited to what is adequate, relevant and reasonably necessary for disclosed purposes; no incompatible use without consent. Section: [KRS 367.3617(1)(a) and (b)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) 2. Privacy notice: data categories, purposes, how to exercise and appeal rights, categories of data shared and categories of third parties. Section: [KRS 367.3617(3)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) 3. Sale of personal data or targeted advertising must be disclosed clearly and conspicuously with how to opt out. Section: [KRS 367.3617(4)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) 4. One or more secure and reliable request methods must be described in the notice; no new account may be required. Section: [KRS 367.3617(5)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) 5. Impact assessments required for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing, for activities created or generated on or after 1 June 2026. Section: [KRS 367.3621(1) and (8)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) 6. No requirement to honour a universal opt-out signal appears in the Act. Section: [KRS 367.3611 to 367.3629](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) 7. 'Sale' means exchange for monetary consideration only. Section: [KRS 367.3611(27)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) ## Sources - [KRS chapter 367 index (sections 367.3611 to 367.3629, current and future versions)](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) - [KRS 367.3621 (data protection impact assessments, as amended 2025)](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56649) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Kentucky statute](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) Reference material, not legal advice. ## Other topics for Kentucky - [Applicability](https://dposchool.com/state-privacy-laws/state/kentucky/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/kentucky/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/kentucky/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/kentucky/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/kentucky/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/kentucky/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/kentucky/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents