DPO SchoolDPO School

Kentucky Consumer Data Protection Act

Kentucky privacy law (KCDPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General has exclusive enforcement authority and investigative powers. Before suing, the Attorney General must give 30 days' written notice, and a cure with an express written statement bars an action for damages; this cure right does not expire. Continued violations or breach of the written statement can lead to damages of up to $7,500 for each continued violation, plus expenses and fees. There is no private right of action.

Key points

  1. The Attorney General has exclusive authority to enforce the Act.

    Section: KRS 367.3627(1)

  2. 30 days' written notice before any action; a cure plus an express written statement bars an action for damages. No sunset.

    Section: KRS 367.3627(2)

  3. Damages of up to $7,500 for each continued violation after the cure period or breach of the written statement.

    Section: KRS 367.3627(3)

  4. No private right of action.

    Section: KRS 367.3627(4)

  5. The Attorney General may recover investigation expenses, court costs and attorney's fees; penalties go to a consumer privacy fund.

    Section: KRS 367.3627(5); KRS 367.3629

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Kentucky statute

Reference material, not legal advice.