Kentucky consumer data privacy act

Beteckning

Beteckning

Ky. Rev. Stat. §§ 367.3611 to 367.3639

Nivå

Delstat KY

Status

I kraft

Antagen

2024-04-04

Tillämpas från

2026-01-01

Tillsynsorgan

Kentucky AG

Namngivna krav

• Applicability and thresholds

  Ky. Rev. Stat. §§ 367.3611 to 367.3639

  100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data.

• Privacy notice

  Ky. Rev. Stat. §§ 367.3611 to 367.3639

  A reasonably accessible notice naming the categories processed, the purposes, the categories shared and how rights are exercised.

• Consumer rights

  Ky. Rev. Stat. §§ 367.3611 to 367.3639

  Access, deletion, portability, correction and opt-out of targeted advertising, sale and certain profiling, with an appeal route.

• Sensitive data

  Ky. Rev. Stat. §§ 367.3611 to 367.3639

  Consent, or in some states a strict necessity standard, before sensitive categories are processed.

• Data protection assessment

  Ky. Rev. Stat. §§ 367.3611 to 367.3639

  A documented assessment for targeted advertising, sale, sensitive data and profiling that carries a heightened risk.

• Processor contract

  Ky. Rev. Stat. §§ 367.3611 to 367.3639

  A written contract that sets instructions, confidentiality, deletion or return, and audit rights.

• Enforcement

  Ky. Rev. Stat. §§ 367.3611 to 367.3639

  Enforced by the state authority. Thirty day cure period that does not sunset in the text.

Officiell källa

• apps.legislature.ky.gov
• www.ag.ky.gov

EU-rättsakter på samma område

• gdpr

  Täcker samma mark som dataskyddsförordningen när det gäller information, rättigheter och biträdesavtal, men med smalare tillämpning och utan ett allmänt krav på rättslig grund.