# Workflows — Kentucky KPPA

## Workflow 1: KPPA Readiness Assessment (Pre-Effective Date)

```
TRIGGER: Preparation for January 1, 2026 effective date
  │
  ├─► Step 1: Applicability Determination
  │     ├─ Confirm Kentucky business nexus
  │     ├─ Count Kentucky consumers (calendar year basis)
  │     ├─ Assess revenue percentage from data sale
  │     ├─ Check entity-level exemptions
  │     └─ Document determination
  │
  ├─► Step 2: Gap Analysis (May - August 2025)
  │     ├─ Compare current privacy program to KPPA requirements
  │     ├─ Identify gaps in:
  │     │     ├─ Privacy notice content
  │     │     ├─ Consumer rights mechanisms
  │     │     ├─ Sensitive data consent procedures
  │     │     ├─ Processor contracts
  │     │     └─ Data protection assessments
  │     └─ Prioritize remediation items
  │
  ├─► Step 3: Privacy Notice Update (September 2025)
  │     ├─ Add Kentucky-specific disclosures
  │     ├─ Include consumer rights exercise instructions
  │     ├─ Disclose data sharing and third-party categories
  │     └─ Legal review and approval
  │
  ├─► Step 4: Technical Implementation (October - November 2025)
  │     ├─ Deploy Kentucky consumer rights portal
  │     ├─ Implement opt-out mechanisms for targeted ads, sale, profiling
  │     ├─ Configure sensitive data consent collection
  │     ├─ Build consumer request tracking with 45-day SLA
  │     └─ Implement appeal process with 60-day SLA
  │
  ├─► Step 5: DPIAs (October - December 2025)
  │     ├─ Identify processing activities requiring DPIAs
  │     ├─ Complete assessments for targeted advertising, sale, profiling
  │     ├─ Complete assessments for sensitive data processing
  │     └─ Retain for AG access
  │
  ├─► Step 6: Training (November - December 2025)
  │     ├─ Train privacy team on KPPA requirements
  │     ├─ Train customer service on consumer rights handling
  │     └─ Conduct tabletop exercise for consumer requests
  │
  └─► Step 7: Go-Live (January 1, 2026)
        ├─ Activate Kentucky privacy portal
        ├─ Begin processing Kentucky consumer requests
        └─ Monitor for AG guidance or enforcement signals
```

## Workflow 2: Consumer Rights Request Processing

```
START: Kentucky consumer submits privacy request (after January 1, 2026)
  │
  ├─► Step 1: Log and Classify
  │     ├─ Assign: KY-REQ-YYYY-NNNNN
  │     └─ Day 0 of 45-day clock
  │
  ├─► Step 2: Authenticate
  │     └─ Commercially reasonable verification
  │
  ├─► Step 3: Process (45 days, 45-day extension available)
  │     └─ Execute per right type
  │
  ├─► Step 4: Respond
  │     ├─ Fulfill or deny with basis
  │     └─ Inform of appeal right
  │
  └─► Step 5: Appeal (if filed)
        ├─ Respond within 60 days
        └─ If denied: inform of AG contact (ag.ky.gov)
```