1. Home
  2. State breach laws
  3. Kentucky

Kentucky data breach notification law

What Kentucky requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Ky. Rev. Stat. § 365.732 (businesses); Ky. Rev. Stat. §§ 61.931–61.934 (public agencies).

No fixed deadline
Notification deadline
Not required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Kentucky sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. There is no Attorney General notice requirement, so Kentucky incidents surface mainly through SEC and HHS filings and through other states' records, channels fewer competitors watch. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Kentucky breach filings →

Requirements in detail

Statute
Ky. Rev. Stat. § 365.732 (businesses); Ky. Rev. Stat. §§ 61.931–61.934 (public agencies)
Deadline to notify residents
For businesses, in the most expedient time possible and without unreasonable delay after discovery, subject to law enforcement needs and steps needed to determine the scope of the breach. Public agencies must notify affected individuals within 35 days after sending their post-investigation notices to state officials.
Attorney General notification
No for private businesses under § 365.732. Businesses must notify the nationwide consumer reporting agencies when more than 1,000 people are notified at one time. Yes for public agencies, which must notify the Attorney General, the Commissioner of the Kentucky State Police, and the Auditor of Public Accounts within 72 hours of determining that a breach occurred (KRS 61.933).
Penalties
Section 365.732 does not specify any civil penalty or enforcement mechanism. For public agencies, KRS 61.933 authorizes the Attorney General to seek injunctive relief.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Kentucky's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Kentucky has no law limiting breach lawsuits for organizations that maintain a security program.

Kentucky breach notification FAQ

What is the data breach notification deadline in Kentucky?

For businesses, in the most expedient time possible and without unreasonable delay after discovery, subject to law enforcement needs and steps needed to determine the scope of the breach. Public agencies must notify affected individuals within 35 days after sending their post-investigation notices to state officials. The governing law is Ky. Rev. Stat. § 365.732 (businesses); Ky. Rev. Stat. §§ 61.931–61.934 (public agencies).

Does Kentucky require notifying the Attorney General of a data breach?

No for private businesses under § 365.732. Businesses must notify the nationwide consumer reporting agencies when more than 1,000 people are notified at one time. Yes for public agencies, which must notify the Attorney General, the Commissioner of the Kentucky State Police, and the Auditor of Public Accounts within 72 hours of determining that a breach occurred (KRS 61.933).

What are the penalties for failing to report a data breach in Kentucky?

Section 365.732 does not specify any civil penalty or enforcement mechanism. For public agencies, KRS 61.933 authorizes the Attorney General to seek injunctive relief.

Can individuals sue over a data breach in Kentucky?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Kentucky?

Kentucky's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Kentucky limit breach lawsuits for companies with a cybersecurity program?

No. Kentucky has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Kentucky Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →