The Office of Data Privacy was created to enforce the Kentucky Consumer Data Protection Act (“KCDPA") which became effective on January 1, 2026. The Office has exclusive authority to enforce the KCDPA and may seek injunctive relief, civil penalties and reasonable attorneys' fees and investigative costs.
The KCDPA governs how certain business entities (“controllers") collect, use, process, and maintain the personal data of Kentucky consumers. It grants consumers specific rights regarding their personal data, including the right to:
- request confirmation of whether a controller is processing their personal data;
- correct inaccuracies in their personal data;
- delete personal data provided by or obtained about them;
- obtain a portable and readily usable copy of their data, when feasible; and
- opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.
The KCDPA also requires controllers to provide consumers with an accessible, clear, and meaningful privacy notice explaining the types of personal data collected, the purposes for processing, the methods for exercising KCDPA rights (including how to appeal a denial), and other required disclosures.
Controllers must respond to consumer requests, free of charge, up to twice per year, and must respond to requests within forty-five (45) days. If a controller declines to act on a request, it must provide its justification and instructions for filing an appeal. Controllers must also offer consumers an online mechanism—if available—or another means to contact the Office of the Attorney General to submit a complaint. In addition, the KCDPA requires specific contractual terms between controllers and processors.