Data Breach Notice to Residents and State Authorities in Kentucky
At a glance
| Covered entity and service provider | KY business information holder notifies residents; nonowner data maintainer notifies owner/licensee as soon as reasonably practicable (§ 365.732(1)(b), (2)-(3)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of unencrypted/unredacted computerized PI in multi-person database; name plus SSN, license, or financial access (§ 365.732(1)(a),(c)) |
| Risk screen or notice exception | Breach definition requires actual or reasonably believed identity theft/fraud; good-faith employee acquisition excluded (§ 365.732(1)(a)) |
| Individuals who receive notice | KY residents whose unencrypted PI was or is reasonably believed acquired without authorization after qualifying breach (§ 365.732(2)) |
| Individual notice deadline and clock | Most expedient time possible, without unreasonable delay after discovery/notification; no fixed outer day limit (§ 365.732(2)) |
| Regulator threshold and deadline | No general AG report in § 365.732; qualifying insurance licensee reports to insurance commissioner within 3 business days after event determination (§§ 365.732, 304.3-760(1)) |
| Consumer-reporting-agency notice | More than 1,000 persons at one time: all nationwide agencies and credit bureaus without unreasonable delay; timing, distribution, content (§ 365.732(7)) |
| Individual delivery and content | Written or qualifying electronic notice; § 365.732 prescribes no itemized resident-letter contents (§ 365.732(2),(5)) |
| Substitute notice conditions and channels | Cost over $250,000, class over 500,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 365.732(5)(c)) |
| Delays and alternate compliance | Police impediment delay until prompt notice after clearance; timing-consistent own policy; federal GLBA/HIPAA entities excluded (§ 365.732(4),(6),(8)) |
Requirements one by one
The breach and risk threshold
KRS § 365.732(1)(a) defines a breach as unauthorized acquisition of unencrypted and unredacted computerized data in a database concerning multiple people that actually causes, or leads the information holder reasonably to believe it has caused or will cause, identity theft or fraud against a Kentucky resident. Good-faith employee or agent acquisition for the business is excluded if there is no further unauthorized use or disclosure.
Subsection (1)(c) covers a name paired with a Social Security number, driver's license number, or account or card number plus required access data. The general provision does not list medical or online-account credentials by themselves.
Resident, owner, and agency notice
An information holder tells Kentucky residents whose unencrypted information was or is reasonably believed acquired by an unauthorized person under § 365.732(2). The notice must go in the most expedient time possible and without unreasonable delay after discovery or notification; the subsection sets no fixed outer day count. A nonowner holder notifies the owner or licensee as soon as reasonably practicable after discovery under subsection (3).
When a person discovers circumstances requiring notice to more than 1,000 people at one time, subsection (7) adds notice without unreasonable delay to all nationwide consumer reporting agencies and credit bureaus. The agency report describes the timing, distribution, and content of individual notices. Section 365.732 does not impose a general Attorney General report.
Delivery and substitute channels
Section 365.732(5) permits written or qualifying electronic notice. If direct notice would cost over $250,000, the affected class exceeds 500,000, or contacts are insufficient, substitute notice requires email where available, a conspicuous website post if the business has a site, and major statewide media.
What trips people up
Insurance licensees may have a faster regulator clock. KRS § 304.3-760(1) requires a qualifying licensee to notify the insurance commissioner as promptly as possible, no later than three business days after determining a covered cybersecurity event. Subsection (3) still requires compliance with § 365.732 where applicable. The insurance rule has its own domicile, home-state, and affected-consumer conditions.
Police delay ends with a prompt notice duty. Under § 365.732(4), notice may wait if law enforcement determines it would impede a criminal investigation. The holder must notify promptly when the agency determines notice no longer compromises the investigation.
The internal-policy route is conditional. Subsection (6) deems a holder compliant if its policy is consistent with statutory timing and it follows that policy. Subsection (8) excludes entities subject to the cited federal financial-privacy or HIPAA laws, as well as government agencies, from this section.
Common questions
Is every unencrypted incident a breach under Kentucky's definition?
No. Section 365.732(1)(a) also requires actual or reasonably believed identity theft or fraud against a Kentucky resident.
Does Kentucky require a standard letter with specified contents?
Section 365.732(2) requires disclosure to affected residents, and subsection (5) gives delivery methods. The section does not enumerate a required list of resident-letter details.
Statutes and sources
- KRS § 365.732 — general private breach notice.
- KRS § 304.3-760 — insurance-licensee commissioner notice.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Kentucky law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Kentucky law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace