Esheria Regulatory Atlas

Data protection in United States — Kentucky

Personal data, privacy, cybersecurity duties, processing, and cross-border transfers. These records come from release legal-2026.07.26-907 and link directly to stored legal text.

174 matching statutes

• United States — Kentucky

  KRS § 367.3621 Data protection impact assessment -- Requirements -- Disclosure to Attorney General -- Confidentiality and exceptions -- Application.

  1 provisions

  Controllers must conduct and document data protection impact assessments for listed personal-data processing activities, and the Attorney General may request and review them.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 194A.099 Division of Health Benefit Exchange within Office of Data Analytics to administer the Patient Protection and Affordable Care Act of 2010 -- Powers and duties -- Administrative regulations -- Office of Data Analytics not to establish procedures and rules that conflict with the Patient Protection and Affordable Care Act.

  1 provisions

  The Division of Health Benefit Exchange and the Office of Data Analytics must carry out exchange-related duties, may make certain agreements, must seek federal funding, must issue regulations, and must not make rules that conflict with the Affordable Care Act.

  Regulation Open & Chat

• United States — Kentucky

  KRS § 311.705 Genetic testing -- Guidelines for collection and use of genetic data.

  1 provisions

  Direct-to-consumer genetic testing companies must give consumers clear privacy information, get required consents, secure genetic data, provide access/deletion/destruction processes, and restrict certain disclosures.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 367.3613 Application -- Limitations -- Information and data exemptions -- Compliance with federal children's online privacy laws.

  1 provisions

  This section applies Kentucky data privacy rules to certain businesses and consumers, but excludes listed entities and data types, and treats COPPA parental-consent compliance as compliance with the section’s parental-consent requirement.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 367.3617 Limitations on the collection and use of personal data by a controller -- Waiver of consumer rights contrary to public policy -- Privacy notice -- Notice for sale of personal data to third party -- Process for consumers to exercise consumer rights requirement. (Effective until July 1, 2027)

  1 provisions

  Controllers must limit personal data collection and processing, protect data with reasonable security practices, give a clear privacy notice, and provide secure ways for consumers to exercise rights.

  Notice Open & Chat

• United States — Kentucky

  KRS § 367.3617 Limitations on the collection and use of personal data by a controller -- Waiver of consumer rights contrary to public policy -- Privacy notice -- Notice for sale of personal data to third party -- Process for consumers to exercise consumer rights requirement. (Effective July 1, 2027)

  1 provisions

  Controllers must limit personal data collection and use, protect data with reasonable security practices, avoid unlawful discrimination and certain unauthorized processing, provide a clear privacy notice, and offer secure ways for consumers to exercise rights.

  Notice Open & Chat

• United States — Kentucky

  KRS § 194A.065 Recording of data elements for centralized criminal history record information system -- Definition of front-line staff.

  1 provisions

  This section defines “front-line staff” and requires several agencies to record and share criminal-history data, while letting designated staff request and use state criminal background checks for protective services work.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 367.3619 Data processing responsibilities to controller -- Contract requirements between controller and processor.

  1 provisions

  Processors must follow controller instructions and help with data protection duties, contract terms, confidentiality, deletion/return of data, assessments, and subcontractor controls.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 367.3625 Construction of KRS 367.3611 to 367.3629 -- Uses of data by controller or processor -- Application of evidentiary privilege -- Disclosure of data to third-party controller -- Limitations on processing of personal data -- Burden of proof.

  1 provisions

  This section mainly limits how controllers and processors may use personal data, while allowing several listed exceptions and use cases.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 456.020 Interpretation of chapter.

  1 provisions

  This chapter is to be read as protecting victims, enabling law enforcement and peace officers to respond to protection-order violations, supporting data collection, and preserving existing duties, responsibilities, services, and penalties in related chapters.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 403.715 Interpretation of KRS 403.715 to 403.785.

  1 provisions

  This section says the protection-order laws should be read to help victims get short-term protection, let peace officers act quickly on probable cause, let courts hold contempt proceedings, and collect domestic-violence data.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 311.710 Legislative findings.

  1 provisions

  This section states Kentucky’s legislative findings about abortion, pregnant women, unborn children, and the need for accurate maternal-health statistics.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 151.629 Interagency Technical Advisory Committee on Groundwater -- Duties and responsibilities.

  1 provisions

  This section creates a groundwater committee and requires it to have specific members and perform several groundwater-planning and review duties.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 42.731 Duties of Artificial Intelligence Governance Committee -- Duties of Commonwealth Office of Technology regarding artificial intelligence systems -- Establishment of policies and operating standards on use of artificial intelligence by state agencies -- Report -- Administrative regulations.

  1 provisions

  The Commonwealth Office of Technology must set up and run AI governance policies, standards, reporting, and oversight for state entities, including disclosure, privacy, and risk-management rules.

  Regulation Open & Chat

• United States — Kentucky

  KRS § 214.645 Reporting system of HIV-positive persons -- Confidentiality and reporting requirements -- Reporting system surveillance, assessment, and restrictions.

  1 provisions

  The cabinet must run a named HIV reporting system and impose confidentiality, security, assessment, and breach-response rules.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 312.160 Appeal -- Reporting of disciplinary matters.

  1 provisions

  A licensed person disciplined after a hearing may appeal to the Franklin Circuit Court, and disciplinary matters must be reported to the Healthcare Integrity and Protection Data Bank or the board’s authorized agent.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 257.495 Board not to release agricultural or food system information considered part of critical infrastructure -- Exceptions.

  1 provisions

  The board generally may not release agricultural or food system records, data, or information treated as critical infrastructure, except in two stated situations.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 315.038 Definitions for section -- Ambulatory pharmacies -- Reporting requirements -- Data to be shared with commissioner of insurance -- Contract with third-party to collect or process data.

  1 provisions

  Ambulatory pharmacies in Kentucky must report dispensing-cost data to the board on a set schedule, and the board must share the data with the commissioner and keep it confidential.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 151B.133 Duties of Office of the Kentucky Center for Statistics.

  1 provisions

  The Office of the Kentucky Center for Statistics must carry out a set of data, research, privacy, reporting, and administration duties for the Kentucky Longitudinal Data System.

  Act or statute Open & Chat

• United States — Kentucky

  KRS § 216.2927 Types of data not to be published, released, or subject to inspection -- Public-use data agreements and privacy rules -- Confidentiality of raw data -- Penalty for violation.

  1 provisions

  The cabinet and its staff must keep certain patient and provider-related data confidential, limit who can access raw data, and release only non-identifying aggregate data after the stated delay. Violations by cabinet employees can trigger fines, jail, and removal from office or employment.

  Rule Open & Chat