Kentucky SaaS Agreement Review
Kentucky's Consumer Data Protection Act, KRS 367.3611 and following, took effect January 1, 2026. It is closely modeled on Virginia's law, so it requires controllers to put processors under contract. For a Louisville or Lexington business buying software in 2026, it is the first time Kentucky law has said anything about what a vendor's data processing terms must contain.
Consumer privacy law in Kentucky
Kentucky Consumer Data Protection Act (KCDPA)
In force since January 1, 2026. Applies at 100,000 consumers, or 25,000 consumers where more than 50% of revenue comes from selling personal data.
Data rights in Kentucky
Kentucky has enacted the Kentucky Consumer Data Protection Act (KCDPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Kentucky residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What does Kentucky's privacy law require of SaaS vendors?
The Act applies to businesses that control or process data of at least 100,000 Kentucky consumers a year, or at least 25,000 while earning more than 50% of gross revenue from selling personal data. A processor must work under a contract that sets out instructions, the type and duration of processing, confidentiality, deletion or return of data at the end of service, and subcontractor flow down.
The Attorney General enforces it, must give 30 days' notice and a chance to cure, and the cure right does not expire. Penalties reach $7,500 per violation.
Kentucky breach notice and state contractors
KRS 365.732 requires notice to affected residents in the most expedient time possible, and credit bureau notice above 1,000 people. A vendor maintaining data for another business must notify it as soon as reasonably practicable. Companies that contract with state agencies face a stricter rule under KRS 61.931 and following: notice to the agency within 72 hours of determining a breach occurred.
Who is outside Kentucky's breach statute?
Entities subject to Title V of the Gramm-Leach-Bliley Act or to HIPAA are excluded. For everyone else, notice is required only where the breach causes, or is reasonably believed to cause, identity theft or fraud against a Kentucky resident. Personal information is defined narrowly as a name plus a Social Security number, license number, or account number with an access code.
Kentucky sources checked 2026-10-09: Ashurst Perkins Coie, Kentucky breach chart. Laws change; confirm the current rule before relying on it.
Kentucky SaaS agreement FAQ
Does Kentucky have a data privacy law that affects SaaS contracts?
Yes. Kentucky has enacted a comprehensive consumer privacy law, the Kentucky Consumer Data Protection Act (KCDPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Kentucky residents. Note the scope: In force since January 1, 2026. Applies at 100,000 consumers, or 25,000 consumers where more than 50% of revenue comes from selling personal data.
Can a SaaS vendor use my Kentucky business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Kentucky law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Kentucky?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Kentucky law in about a minute.
Does Kentucky's 72-hour rule apply to private SaaS deals?
No. The 72 hour notice applies to private companies that contract with Kentucky state agencies. For private deals, KRS 365.732 only requires notice as soon as reasonably practicable, so write a specific window into the contract if you want one.
Is a small Kentucky business covered by the new privacy act?
Usually not. The thresholds of 100,000 consumers, or 25,000 with heavy revenue from data sales, exclude most small firms. Even so, a small business should still negotiate deletion, confidentiality and use limits, because nothing else in Kentucky law will supply them.
Reviewing a SaaS contract in Kentucky?
Upload it and get the data, liability, and renewal terms checked against Kentucky law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Kentucky law when you run your agreement, and you should confirm anything critical with a qualified attorney.