Kentucky Consumer Data Protection Act, KRS 367.3611–.3629
Enacted in force
Jurisdiction
Kentucky [source]
Applies to
Persons doing business in Kentucky or targeting residents, processing 100,000+ consumers, or 25,000+ AND >50% gross revenue from sales. Government, financial/HIPAA entities, nonprofits, higher education, and other exemptions apply. [source]
Penalty
Unverified
Detail review
Accepted record facts reviewed
Nov 13, 2026
In plain English
- Persons doing business in Kentucky or targeting residents, processing 100,000+ consumers, or 25,000+ AND >50% gross revenue from sales. Primary source
- Government, financial/HIPAA entities, nonprofits, higher education, and other exemptions apply. Primary source
Dates and phased obligations
January 1, 2026 Primary source
· effective
January 1, 2026 Primary source
Questions from this record
Who does KY KCDPA cover?
Persons doing business in Kentucky or targeting residents, processing 100,000+ consumers, or 25,000+ AND >50% gross revenue from sales. Government, financial/HIPAA entities, nonprofits, higher education, and other exemptions apply. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
January 1, 2026 Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
Primary sources
Verification history
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.
Compare the tracked rulesDates, coverage, and sources in one quarterly file.
View the matrix