Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Kentucky |
|---|---|
| Statute citation | This state has 2 separate breach notification statutes: • Private Sector: KRS § 365.732 (Trade Practices - Security Breach Notification) (amended |
| Individual notice timing | notify affected individuals in the most expedient time possible without unreasonable delay, consistent |
| Attorney general notice | Yes Kentucky requires government agencies to notify the Attorney General (and other officials) within 72 |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | Not extracted in our PRC 2026 summary; check the statute. |