Preparing for the Kentucky Consumer Data Protection Act

Kentucky’s newly enacted Consumer Data Protection Act (HB 15) will take effect on January 1, 2026, placing the Commonwealth among the growing list of states enacting comprehensive data privacy laws. The law applies to businesses that:

• Control or process data of 100,000 or more Kentucky residents annually, or
• Derive more than half of their gross revenue from the sale of personal data and process data for at least 25,000 Kentucky consumers.

Under the KCDPA, consumers gain the right to:

• Access their personal data,
• Correct inaccuracies,
• Request deletion,
• Opt out of targeted advertising and data sales,
• Receive data portability.

Businesses must publish clear privacy policies, provide a secure method for consumers to exercise their rights, and respond within 45 days of receiving a verified request. Covered entities must also conduct data protection assessments for certain processing activities, particularly those involving sensitive personal information. The Kentucky Attorney General has exclusive enforcement authority and may impose civil penalties of up to $7,500 per violation.

To prepare, businesses should:

• Inventory all consumer data collected,
• Update website privacy notices,
• Develop internal workflows for verifying and responding to consumer requests,
• Coordinate legal and IT teams to establish compliant data governance practices.



While small businesses may be exempt, consumer expectations are shifting. Even non-covered entities should consider voluntary adoption of transparent data practices to build trust and avoid reputational risk under Kentucky’s growing privacy framework.