Kentucky Data Breach Notification Law

The Kentucky data breach notification law: no day count, no state filing

KRS 365.732 has stood unchanged since July 15, 2014 ¹. Its timing rule starts when a business finds a breach or is told about one, and from there notice should go out in the most expedient time possible and without unreasonable delay, with allowance for a police hold and for the work of sizing up the damage and repairing systems.

What it leaves out is striking: no state filing, no penalty amount, no named enforcer ¹. The bureaus, at more than 1,000 people notified at one time, are the only outsiders who hear about it.

Without a number of days, the business effectively writes its own deadline and has to be able to defend it. Keep a dated log of three moments: when you first learned of the incident, when the forensic team confirmed what was taken, and when the letters were mailed. That log is the evidence that the timing was reasonable.

When a Kentucky incident counts as a breach

An incident is a breach in Kentucky only if the acquisition of unencrypted, unredacted data actually causes identity theft or fraud against a Kentucky resident, or leads the business to reasonably believe it has caused or will cause it ¹. The harm test sits inside the definition itself. Kentucky does not demand paperwork for a decision to stay quiet, though a short memo of what the investigation showed is cheap insurance.

Records that were encrypted or redacted are out of scope ¹. A stolen key is not mentioned anywhere in the statute, which makes that scenario one to raise with counsel rather than assume away.

Who is exempt, and the own-policy option

Two groups sit outside KRS 365.732 altogether: entities under the Gramm-Leach-Bliley Act and those under HIPAA ¹. Their federal rules govern instead; a medical office can start with the federal patient notice rule explained.

A business with a written notice policy of its own, timed in line with the statute, is deemed to comply ¹. Service providers that only hold someone else's records, an accounting platform for example, must warn the owner as soon as reasonably practicable.

With no penalty or enforcer written in, nobody can say yet whether a resident could use Kentucky's general damages statute to sue. Ask counsel; do not treat the gap as permission to stay quiet.

Kentucky's privacy law and the wider picture

Starting January 1, 2026, Kentucky's Consumer Data Protection Act reaches companies processing data on at least 100,000 Kentucky consumers a year, or 25,000 when over 50% of gross revenue comes from selling personal data ². Few small firms cross those lines, and the thresholds are the privacy act's, not the breach law's. On the crime side, IC3 took in 9,414 complaints from Kentuckians in 2025 ³.

First moves after a breach in Kentucky

Still under attack? Insured firms open a claim with the carrier first, then go to ic3.gov to tell the FBI; disk images and logs get saved before a single machine is rebuilt ⁴⁵⁶.

After that, an outside incident handling firm, or your own IT support, finds out what was taken while someone sorts the affected people by state. An Ohio or Tennessee customer brings a 45-day deadline that is tighter than Kentucky's; other states are in every state's breach rule in one table. The conditions cyber carriers attach to coverage often decide which lawyer and forensic firm you may use. If you have no IT provider to call, our Louisville and Lexington guides cover what local support costs.

Checked against KRS 365.732 on October 13, 2026, this page summarizes the law for owners and managers and does not amount to legal advice. Kentucky counsel can say how it fits your facts.