Kentucky Consumer Data Protection Act
Kentucky privacy law (KCDPA): processors
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Processors must follow controller instructions and help with rights requests, security and breach notification, and impact assessments. A binding contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and require confidentiality, deletion or return, compliance information, assessments and flow-down to subcontractors. The role of controller or processor is decided on the facts.
Key points
Processors must assist with rights requests, security and breach notification, and impact assessments.
Section: KRS 367.3619(1)
The contract must be binding and set out instructions, nature and purpose, data types, duration, and rights and obligations of both parties.
Section: KRS 367.3619(2)
Required terms: confidentiality, deletion or return at the end of services, compliance information on request, assessments (or an independent assessment), and written flow-down contracts with subcontractors.
Section: KRS 367.3619(2)(a) to (e)
The contract does not relieve either party of its own liabilities.
Section: KRS 367.3619(3)
Controller or processor status is a fact-based determination.
Section: KRS 367.3619(4)
Sources
Compare processors across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 28: Processor (processors)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Kentucky statute
Reference material, not legal advice.