Use Kentucky consumer data rights

Check the context and coverage

The current statutory definition covers a Kentucky resident acting in an individual context, excluding commercial or employment contexts. Coverage also depends on the business, dataset and statutory exceptions. KRS 367.3611: current consumer definition · KRS 367.3613: covered businesses and exemptions

The Act does not cover every holder of information. State and local government bodies are among the exempt entities. A police records request follows a different law. KRS 367.3613: covered businesses and exemptions

Make a specific request

1. Find the business's privacy notice and its request channel. The notice must explain how to exercise rights and appeal denials. KRS 367.3617: privacy notices and request channels
2. Specify the rights you want to invoke: confirmation and access, correction, deletion, a portable copy where applicable, or an opt-out for targeted advertising, data sales or qualifying profiling. KRS 367.3615: consumer requests and appeals
3. Use the official channel and complete reasonable authentication. A controller may ask for information needed to authenticate the consumer and request. KRS 367.3615: consumer requests and appeals

Watch the response and appeal clocks

The ordinary response period is 45 days, with one further 45-day extension when reasonably necessary and explained within the initial period. If a request is denied, use the business's appeal process. The appeal response is due within 60 days; a denied appeal must include a route to contact the Attorney General. KRS 367.3615: consumer requests and appeals

Read the fee and deletion limits

Responses are free up to twice annually per consumer. Excessive, repetitive, technically infeasible or manifestly unfounded requests may incur a reasonable fee or refusal; the controller bears the burden of showing that condition. KRS 367.3615: consumer requests and appeals

For data obtained from another source, the statute allows retaining the request and minimum data needed only to keep the consumer's data deleted, or opting the consumer out of processing except statutory exemptions, as compliance with a deletion request. KRS 367.3615: consumer requests and appeals

Keep the request and response

The Attorney General's guide identifies the Kentucky Office of Data Privacy complaint route and explains that enforcement belongs to the Attorney General. Save the request, response and any appeal so the sequence can be reviewed. Kentucky AG: consumer data rights