AN ACT relating to consumer data privacy.

Create new sections of KRS Chapter 367 to define terms; set the parameters for applicability of this Act; define various consumer rights related to data collection; require a data controller to comply with a consumer request to exercise those rights; require controllers to establish a process for consumers to appeal a controller's refusal to act on a consumer's request to exercise a right; set forth requirements for persons or entities that control or process personal data; require persons who control data to conduct data protection impact assessments; establish that the Attorney General has exclusive authority to enforce this Act and shall provide a controller or processor 30 days' written notice identifying the specific provisions that were violated; provide that if a controller or processor does not cure a violation within 30 days, the Attorney General may initiate an action and seek damages for up to $7,500 for each violation; create a consumer privacy fund in the State Treasury to be administered by the Office of the Attorney General and direct that all civil penalties collected with regard to enforcement actions be deposited in the fund; amend KRS 367.240 to conform; provide that the Act may be cited as the Kentucky Consumer Data Protection Act; EFFECTIVE January 1, 2026.