AN ACT relating to insurance data security.

Create new sections of Subtitle 3 of KRS Chapter 304 to establish definitions; require licensees to conduct risk assessments; require licensees to develop an information security program, including an incident response plan; require licensees to investigate cybersecurity events and potential cybersecurity events; establish recordkeeping requirements relating to cybersecurity events; establish reporting requirements relating to cybersecurity events; require licensees to comply with KRS 365.732; provide exceptions for certain provisions; authorize the commissioner to examine and investigate licensees for potential violations and take action necessary to enforce relevant provisions; establish how and under what circumstances documents, materials, or other information may be used or disclosed; prohibit the commissioner or other persons acting on under the authority of the commissioner from testifying in a private civil action concerning confidential documents, materials, or other information; provide that a licensee may be penalized for violations in accordance with KRS 304.99-020; authorize the commissioner to promulgate administrative regulations pursuant to KRS 304.2-110; provide for severability; establish a timeframe for implementation of certain provisions; EFFECTIVE January 1, 2023.