Kentucky Legislature Passes Comprehensive Data Privacy Bill: H.B. 15 Signed into Law by Governor

Kentucky Passes Comprehensive Data Privacy Law, Governor Signs Bill

In a landmark move, the Kentucky legislature passed a comprehensive data privacy bill, known as H.B. 15, on March 27, 2024. The bill was subsequently signed into law by Governor Andy Beshear on April 4, 2024, making Kentucky the 16th state to enact such legislation.

H.B. 15 aims to protect the personal data of Kentucky residents by imposing obligations on businesses that control or process a significant amount of consumer data. The law applies to entities that conduct business in Kentucky or target Kentucky residents and handle personal data of at least 100,000 consumers annually, or 25,000 consumers while deriving more than 50% of revenue from the sale of personal data.

Under the new law, controllers must limit the collection of personal data to what is necessary for disclosed purposes, implement data security practices, obtain consumer consent for certain data processing activities, and conduct data protection impact assessments for specific purposes. Additionally, controllers are required to provide consumers with clear privacy notices and grant them rights to access, correct, and delete their personal data.

Importantly, H.B. 15 does not include a private right of action, meaning enforcement will be carried out solely by the Kentucky Attorney General. Controllers and processors have a 30-day cure period to address alleged violations before facing potential penalties.

The law is set to take effect on January 1, 2026, giving businesses time to adjust their data handling practices to comply with the new requirements. With the enactment of H.B. 15, Kentucky joins a growing number of states taking proactive steps to safeguard consumer data in an increasingly digital world.