Kentucky, Indiana, and Rhode Island will kick off the new year
by effectuating comprehensive consumer data privacy laws, ushering
in new compliance obligations for businesses nationwide that meet
the new laws' thresholds. These laws – the Kentucky
Consumer Data Privacy Act (KCDPA), the Indiana Consumer Data
Protection Act (ICDPA), and the Rhode Island Data Transparency and
Privacy Protection Act (RIDTPPA) – reflect the continued
momentum of state-level privacy regulation and will bring the total
number of states with comprehensive consumer privacy laws in force
to 19.
KCDPA and ICDPA closely track the frameworks established by
other state privacy regimes, applying to companies that do business
in the state and annually either process data from at least 100,000
residents or from at least 25,000 residents while deriving more
than 50% of their annual revenue from the sale of personal
information. Both laws exempt nonprofits, higher education
institutions, and entities
