Kentucky Privacy Laws
Mandated Timeframe
Without unreasonable delay
Violations
Up to $2,000
REGULATION LEVELS
 Breach Reporting |
Consumer Notifications |
|---|---|
| Vendor Management |
 Vendor Contract Required |
LEVEL DESCRIPTION
| Minimal |
Basic |
 Comprehensive |
 Extensive |
|---|
Mandated Timeframe
Without unreasonable delay
Violations
Up to $2,000
REGULATION LEVELS
| Breach Reporting |
Consumer Notifications |
|---|---|
| Vendor Management |
Vendor Contract Required |
LEVEL DESCRIPTION
| Minimal |
Basic |
Comprehensive |
Extensive |
|---|
Mandated Timeframe
Without unreasonable delay
Violations
Up to $2,000
REGULATION LEVELS
| Breach Reporting |
Consumer Notifications |
|---|---|
| Vendor Management |
Vendor Contract Required |
LEVEL DESCRIPTION
| Minimal |
Basic |
Comprehensive |
Extensive |
|---|
Kentucky Privacy Law Information
-
Privacy Program
Organizations and Vendors in the business of destroying records must have measures in place for the secure destruction of records containing personal information so the records are unreadable or indecipherable.
-
Breach Reporting
If notification is required for more than 1,000 consumers, the breached Organization must also notify all consumer reporting agencies and credit bureaus.
-
Consumer Notification
Breach notification without delay must be given to any resident of Kentucky affected by a breach that includes personal information.
-
Vendor/Third Parties
Vendors must notify Organizations as soon as possible after the discovery of a breach or suspected breach. The Organization will be responsible to complete any required regulatory reporting and consumer notification.
-
Industry Specific Laws
Additional requirements may apply to student data and cloud computing service providers.
-
Fines & Penalties
Organizations may be fined or penalized for Vendor violations. Consumers may bring an action to recover damages for violations of the data destruction requirements.
Kentucky
Statutes and Laws
KY REV STAT § 365.725
Destruction of customer’s records containing personally identifiable information
KY REV STAT § 365.732
Notification to affected persons of computer security breach involving their unencrypted personally identifiable information