Kentucky Consumer Data Protection Act: Key Takeaways For The New Bluegrass Statute

As we begin 2026, Kentucky has officially enacted the Kentucky Consumer Data Protection Act (KCDPA), a comprehensive privacy statute that took effect on January 1, 2026. As with Indiana, is KCDPA is modeled on the now‑familiar Virginia‑style framework. The KCDPA establishes consumer data rights, imposes governance obligations on businesses, and grants exclusive enforcement authority to the Kentucky Attorney General.

What Entities Are Covered?

The KCDPA applies to persons (defined, under Kentucky law, to include businesses and other organizations) that conduct business in Kentucky or produce products or services targeted to Kentucky residents and, during a calendar year, either control or process personal data of at least 100,000 consumers or control or process personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.