Kentucky Consumer Data Protection Act (KCDPA) Awareness Course
Kentucky became one of the latest US states to enact comprehensive consumer privacy legislation with the KCDPA, signed into law in April 2024. Taking effect January 1, 2026, this law establishes important data protection rights for Kentucky residents and obligations for businesses handling their personal information.
This course gives your team practical guidance on the Kentucky Consumer Data Protection Act. We cover who the law applies to, the rights Kentucky consumers have over their data, sensitive data requirements, and how enforcement works through the Attorney General.
The KCDPA follows the Virginia model but includes a permanent 30-day cure period that never sunsets - more business-friendly than states where the cure period expires. The law defines "sale" as monetary transactions only, which narrows compliance scope. No technical background required - just focused, practical training your team can apply immediately.
Why learn about the KCDPA?
- Prepare your organisation before the January 2026 effective date
- Understand Kentucky-specific thresholds and the narrower "sale" definition
- Know when opt-in consent is required for sensitive data
- Handle consumer data requests correctly within the 45-day timeline
- Leverage the permanent 30-day cure period while building robust compliance
Course features
Kentucky-specific
Focused entirely on the KCDPA with Kentucky-specific requirements, thresholds, and the permanent cure period.
Practical scenarios
Real-world examples and case studies showing how the KCDPA applies in everyday business situations.
Up to date content
Based on the enacted 2024 legislation with all provisions covered ahead of the 2026 effective date.
Official sources
Built from the Kentucky Revised Statutes and official guidance, with references to authoritative documentation.
Learning with us
Course information
Learning outcomes
- Understand when and how the KCDPA applies to your organisation
- Know the rights Kentucky residents have over their personal data
- Recognise sensitive data and understand the opt-in consent requirement
- Handle consumer data requests correctly within required timeframes
- Understand enforcement, the permanent cure period, and compliance best practices
Training recommendations
- All employees who handle customer data should complete this training before the January 2026 effective date.
- Annual refresher training is recommended to stay current with enforcement trends.
- Teams handling sensitive data or consumer requests may benefit from additional role-specific training.
This course is recommended for
Employees who handle customer data at organisations that conduct business in Kentucky or target Kentucky residents. This includes marketing, sales, customer service, HR, IT, and compliance teams.
Prerequisites
There are no prerequisites for this course. No legal or technical background is required.
What do I need for this course?
This course is 100% online and delivered through our online learning platform. Organisations can also access this content via their own LMS on request (SCORM format available).
Course content
In this section we introduce the Kentucky Consumer Data Protection Act and explain why it matters for your organisation. We cover the law's effective date, who it applies to, and the key concepts you need to understand.
Lessons
- Introduction to the KCDPA
- When the law takes effect (January 1, 2026)
- Who the law applies to
- Key definitions explained
Kentucky residents have specific rights over their personal data. In this section we cover what those rights are, how to recognise a valid request, and what your obligations are when you receive one.
Lessons
- The right to confirm and access
- The right to correct inaccurate data
- The right to delete personal data
- The right to data portability
- The right to opt out of sales and targeted advertising
- Responding to consumer requests (45-day timeline)
The KCDPA requires opt-in consent before processing sensitive data. We explain what counts as sensitive data under Kentucky law and how to handle it correctly.
Lessons
- What is sensitive data under KCDPA?
- The opt-in consent requirement
- Children's data and parental consent
- Practical consent implementation
This section covers the operational requirements of the KCDPA including data minimisation, purpose limitation, security obligations, and working with third-party processors.
Lessons
- Data minimisation and purpose limitation
- Security requirements
- Data protection assessments
- Processor contract requirements
Learn what information must be included in your privacy notice under the KCDPA and how to communicate clearly with Kentucky consumers.
Lessons
- Required privacy notice contents
- Disclosure of data sales
- Third-party sharing disclosures
- Updating your privacy policy
Understand the enforcement landscape, the permanent 30-day cure period, and what penalties look like under the KCDPA.
Lessons
- Attorney General enforcement authority
- The permanent 30-day cure period
- Civil penalties explained
- No private right of action
- Building a compliance programme
Test your knowledge with scenario-based questions covering all the key KCDPA concepts from the course.
Lessons
- Knowledge check (10 questions)
How it works
Get notified
Sign up to be notified when this course launches. You'll be among the first to know and can start training your team immediately.
Start learning
Each team member will have access to the learning materials and assessment. On completion of the course, team members will be issued with a certificate.
Stay compliant
As the KCDPA takes effect and enforcement begins, we'll update the course. Trainees can review updated materials to stay current with developments.
What's included
Training
- Distraction-free online learning platform
- Scenario-based end of course assessment
Updates
- Access to all course material updates and enhancements for the length of your access period
Certification
- Certificate on completion
Course FAQs
Yes, on completion of the course you will be issued with a digital certificate. It will be issued by our team shortly after completion of the course including the end of course assessment. You can add this to your LinkedIn profile.
This course is designed for employees who handle customer data at organisations that may be subject to Kentucky's privacy law. This includes marketing, sales, customer service, HR, and IT teams.
The Kentucky Consumer Data Protection Act takes effect on January 1, 2026. Organisations should begin preparing now to ensure compliance by the effective date.
KCDPA applies to organisations that conduct business in Kentucky or target Kentucky residents, AND either: (a) control or process personal data of 100,000+ Kentucky consumers, or (b) control or process data of 25,000+ Kentucky consumers and derive over 50% of gross revenue from selling personal data.
KCDPA follows the Virginia model with opt-out rights for sales and targeted advertising, and opt-in consent for sensitive data. A key difference is the permanent 30-day cure period that never sunsets, and the definition of "sale" is limited to monetary transactions only. Enforcement is exclusively through the Attorney General.
Yes, we offer a 14-day 100% money-back guarantee. If you are not satisfied with the course for any reason, simply contact us within 14 days of purchase for a full refund.
The course typically takes 30-35 minutes to complete. You can pause and resume at any time, and your progress is automatically saved.
Get notified when this course launches
Sign up to our newsletter to be the first to know when this course is available.
This course will be included in Measured Collective Plus
Get access to all our courses with one subscription from £236/year.
Learn About MC Plus
