# Regulatory Standards — Kentucky KPPA

## Primary Legislation

### Kentucky Consumer Privacy Protection Act — KRS §367.401 through §367.445

Enacted: April 4, 2024 (HB 15). Effective: January 1, 2026.

- **§367.401**: Definitions (consumer, controller, processor, personal data, sensitive data)
- **§367.405**: Applicability (100,000 consumers OR 25,000 + 50% revenue)
- **§367.407**: Exemptions (government, GLBA, HIPAA, nonprofits, higher ed, FERPA)
- **§367.409**: Data-level exemptions (GLBA, HIPAA, FERPA, FCRA, DPPA, COPPA data)
- **§367.411**: De-identified data provisions
- **§367.413**: Controller duties (minimization, security, consent, privacy notice)
- **§367.415**: Consumer rights (access, correct, delete, portability, opt-out)
- **§367.417**: Consumer request procedures (45 days, 45-day extension, 60-day appeal)
- **§367.419**: Data protection assessments
- **§367.421**: Processor duties and contracts
- **§367.423-§367.433**: Limitations and construction
- **§367.435**: AG enforcement authority
- **§367.437**: 30-day cure period (permanent)
- **§367.439-§367.445**: Penalties and remedies

## Model Classification

The KPPA follows the **Virginia model** with these characteristics:
- Controller-processor framework (GDPR-influenced)
- Five consumer rights (access, correct, delete, portability, opt-out)
- Opt-in consent for sensitive data
- DPIA requirements
- AG-only enforcement (no private right of action)
- Permanent cure period

## Comparison with Virginia VCDPA

| Provision | Kentucky KPPA | Virginia VCDPA |
|-----------|--------------|----------------|
| Effective date | January 1, 2026 | January 1, 2023 |
| Consumer threshold | 100,000 | 100,000 |
| Revenue threshold | 25,000 + 50% revenue | 25,000 + 50% revenue |
| Consumer rights | 5 (identical set) | 5 (identical set) |
| Sensitive data | Opt-in consent | Opt-in consent |
| Cure period | 30 days (permanent) | 30 days (permanent) |
| DPIA required | Yes | Yes |
| Universal opt-out | Not required | Not required |
| Enforcement | AG only | AG only |
| Penalties | $7,500/violation | $7,500/violation |

## Related Kentucky Laws

### Kentucky Consumer Protection Act — KRS §367.110 et seq.

Enforcement framework for KPPA violations, providing the AG with established enforcement tools.

### Kentucky Data Breach Notification — KRS §365.732

Requires notification to affected individuals following a security breach involving personally identifiable information.