← All US breach laws·KY

Kentucky data breach notification law

Kentucky's data breach notification requirements under Ky. Rev. Stat. §365.732. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Ky. Rev. Stat. §365.732
Enforcer
Kentucky Attorney General
AG notification
Not required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
In the most expedient time possible and without unreasonable delay
Notify the state regulator
No specific AG-notice requirement
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when there is a reasonable likelihood of harm
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Kentucky law

First name/initial + last name with SSN, DL/state ID, financial account + access code

Penalties and enforcement

Enforcement under Consumer Protection Act — civil penalties up to $2,000 per violation
Enforced by: Kentucky Attorney General. Official regulator page →

Common pitfalls

⚠ Kentucky has a separate cloud-computing-in-schools breach law (KRS 365.734) — vendors to K-12 should also map to that

Frequently asked questions

How long do I have to notify Kentucky residents after a data breach?
In the most expedient time possible and without unreasonable delay
Do I have to notify the Kentucky Attorney General?
No specific AG-notice requirement
Does Kentucky require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Kentucky's breach notification requirement?
Yes — Kentucky has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Kentucky residents sue me directly for a data breach?
No — Kentucky's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Kentucky law?
First name/initial + last name with SSN, DL/state ID, financial account + access code
What are the penalties for failing to comply with Kentucky's breach notification law?
Enforcement under Consumer Protection Act — civil penalties up to $2,000 per violation

Related state breach laws

Iowa (IA)
Iowa Code §§715C.1
Kansas (KS)
Kan. Stat. §50-7a02
Louisiana (LA)
La. Rev. Stat. §§51:3071 to 51:3077
Maine (ME)
10 M.R.S.A. §§1346 to 1349

Pre-empt the Kentucky breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Kentucky's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit