Page traduite et vérifiée automatiquement. La version anglaise fait foi. Certaines parties restent en anglais le temps que leur traduction soit vérifiée. Voir en anglais · Signaler une erreur de traduction
KCDPA
Kentucky Consumer Data Protection Act
Loi de type virginien, en vigueur à partir de 2026.
The law in brief
The Kentucky Consumer Data Protection Act (KCDPA) is Kentucky's comprehensive consumer privacy law. It has been in effect since 1 January 2026. Like the other state laws built on the same model, it gives Kentucky residents rights over their personal data and puts duties on the businesses that decide how that data is used (controllers) and on the vendors that handle it for them (processors).
Loi de type virginien, en vigueur à partir de 2026.
À qui elle s’applique
- Entreprises qui traitent des données personnelles des résidents de l’État au-delà des seuils fixés par la loi. Les seuils, les exemptions et les règles relatives aux données sensibles varient d’un État à l’autre.
- The thresholds usually turn on how many Kentucky residents' personal data a business handles in a year, and whether it earns revenue from selling personal data. Check the statute for the exact figures.
- Like most state privacy laws, it exempts some organizations and data, commonly including data already covered by HIPAA or the Gramm-Leach-Bliley Act, and data about people acting in an employment or commercial capacity.
What it requires
A clear privacy notice
Publish a privacy notice describing the categories of personal data you process, why, what you share and with whom, how consumers can use their rights, and how to appeal.
Collect only what you need
Limit collection to what is adequate, relevant and reasonably necessary for the purposes you disclosed, and secure it with reasonable safeguards.
Données sensibles
Get the consumer's opt-in consent before processing sensitive data, such as health information, biometric or genetic data, precise geolocation, and data about a known child (for whom parental consent is needed).
Contracts with processors
Bind each processor by contract to your instructions, confidentiality, deletion or return at the end of the service, and help with audits and assessments.
Honor opt-outs
Stop targeted advertising, sales and, where covered, qualifying profiling for consumers who opt out, and check whether the law requires you to honor universal opt-out signals such as Global Privacy Control.
Data protection assessments
Document an assessment before processing that presents a heightened risk, such as targeted advertising, selling personal data, processing sensitive data, and certain profiling.
Droits des personnes
Kentucky residents can generally ask a business to confirm and access their personal data, correct it, delete it and get a copy in a portable format, and can opt out of targeted advertising, the sale of their data, and profiling that produces legal or similarly significant effects. Businesses generally have 45 days to respond, extendable once. Residents can usually appeal a refusal.
Enforcement and penalties
Application assurée par le procureur général du Kentucky. Les violations sont passibles des sanctions civiles fixées par la loi.
What to do first
- Check the thresholds against your Kentucky consumer numbers and any data sales.
- Map the personal and sensitive data you hold about Kentucky residents.
- Update your privacy notice and add the opt-out routes the law requires.
- Set up requests and appeals within the response deadlines.
- Put KCDPA-ready terms in processor contracts.
- Build one program for all state laws, then add Kentucky's departures.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Évolutions récentes
Rien de signalé pour l’instant. Regulatory Watch recense les nouvelles règles, les mesures d’application et les décisions de justice au fur et à mesure.
Sources
- Toutes les lois générales sur la vie privée qui entrent en vigueur en 2026 MultiState · Cabinet d’avocats ou analyste
- Comparaison des lois sur la vie privée des États américains (24 lois adoptées, dates d’entrée en application) Recording Law · Cabinet d’avocats ou analyste
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.
- En vigueur
- Entrée en vigueur prochaine
- Lois sectorielles