{"data":{"id":"us-ky/krs-61.932","jurisdiction":"us-ky","citation":"KRS 61.932","heading":"Personal information security and breach investigation procedures and","body":"practices for certain public agencies and nonaffiliated third parties.\n(1) (a) An agency or nonaffiliated third party that maintains or otherwise possesses\npersonal information, regardless of the form in which the personal information\nis maintained, shall implement, maintain, and update security procedures and\npractices, including taking any appropriate corrective action, to protect and\nsafeguard against security breaches.\n(b) Reasonable security and breach investigation procedures and practices\nestablished and implemented by organizational units of the executive branch\nof state government shall be in accordance with relevant enterprise policies\nestablished by the Commonwealth Office  of Technology. Reasonable security\nand breach investigation procedures and practices established and\nimplemented by units of government listed under KRS 61.931(1)(b) and (c)\nthat are not organizational units of the executive branch of state government\nshall be in accordance with policies established by the Department for Local\nGovernment. The Department for Local Government shall consult with public\nentities as defined in KRS 65.310 in the development of policies establishing\nreasonable security and breach investigation procedures and practices for units\nof local government pursuant to this subsection. Reasonable security and\nbreach investigation procedures and practices established and implemented by\npublic school districts listed under KRS 61.931(1)(d) sh all be in accordance\nwith administrative regulations promulgated by the Kentucky Board of\nEducation. Reasonable security and breach investigation procedures and\npractices established and implemented by educational entities listed under\nKRS 61.931(1)(e) sha ll be in accordance with policies established by the\nCouncil on Postsecondary Education. The Commonwealth Office of\nTechnology shall, upon request of an agency, make available technical\nassistance for the establishment and implementation of reasonable secu rity\nand breach investigation procedures and practices.\n(c) 1. If an agency is subject to any additional requirements under the\nKentucky Revised Statutes or under federal law, protocols, or\nagreements relating to the protection and privacy of personal\ninformation, the agency shall comply with these additional requirements,\nin addition to the requirements of KRS 61.931 to 61.934.\n2. If a nonaffiliated third party is required by federal law or regulation to\nconduct security breach investigations or to make no tifications of\nsecurity breaches, or both, as a result of the nonaffiliated third party's\nunauthorized disclosure of one (1) or more data elements of personal\ninformation that is the same as one (1) or more of the data elements of\npersonal information list ed in KRS 61.931(6)(a) to (f), the nonaffiliated\nthird party shall meet the requirements of KRS 61.931 to 61.934 by\nproviding to the agency a copy of any and all reports and investigations\nrelating to such security breach investigations or notifications th at are\nrequired to be made by federal law or regulations. This subparagraph\nshall not apply if the security breach includes the unauthorized\ndisclosure of data elements that are not covered by federal law or\nregulation but are listed in KRS 61.931(6)(a) to (f).\n(2) (a) For agreements executed or amended on or after January 1, 2015, any agency\nthat contracts with a nonaffiliated third party and that discloses personal\ninformation to the nonaffiliated third party shall require as part of that\nagreement that t he nonaffiliated third party implement, maintain, and update\nsecurity and breach investigation procedures that are appropriate to the nature\nof the information disclosed, that are at least as stringent as the security and\nbreach investigation procedures an d practices referenced in subsection (1)(b)\nof this section, and that are reasonably designed to protect the personal\ninformation from unauthorized access, use, modification, disclosure,\nmanipulation, or destruction.\n(b) 1. A nonaffiliated third party that  is provided access to personal\ninformation by an agency, or that collects and maintains personal\ninformation on behalf of an agency shall notify the agency in the most\nexpedient time possible and without unreasonable delay but within\nseventy-two (72) hour s of determination of a security breach relating to\nthe personal information in the possession of the nonaffiliated third\nparty. The notice to the agency shall include all information the\nnonaffiliated third party has with regard to the security breach at the time\nof notification. Agreements referenced in paragraph (a) of this\nsubsection shall specify how the cost of the notification and\ninvestigation requirements under KRS 61.933 are to be apportioned\nwhen a security breach is suffered by the agency or non affiliated third\nparty.\n2. The notice required by subparagraph 1. of this paragraph may be delayed\nif a law enforcement agency notifies the nonaffiliated third party that\nnotification will impede a criminal investigation or jeopardize homeland\nor national security. If notice is delayed pursuant to this subparagraph,\nnotification shall be given as soon as reasonably feasible by the\nnonaffiliated third party to the agency with which the nonaffiliated third\nparty is contracting. The agency shall then record th e notification in\nwriting on a form developed by the Commonwealth Office of\nTechnology that the notification will not impede a criminal investigation\nand will not jeopardize homeland or national security. The\nCommonwealth Office of Technology shall promulg ate administrative\nregulations under KRS 61.931 to 61.934 regarding the content of the\nform.","path":["KRS Chapter 61"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43576","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:49:17Z","sha256":"669f01daf7e857428963e52a90e71a2c3f79fd9926731a09a2d803be46e9072d","source_id":"us-ky","stale":false,"prev":"us-ky/krs-61.931","next":"us-ky/krs-61.933"},"notice":"GroundRules: Original legal text. Not legal advice."}