language: en · status: in-force · last checked: 2026-09-07

Kentucky — KRS 61.931 to 61.933 (personal information security; breach investigation)

Created by 2014 Ky. Acts ch. 74, effective 1 January 2015. Kentucky's public-sector data-security regime, and the instrument in this corpus that reaches a school district's suppliers by name: it defines a "nonaffiliated third party", imposes the security duty on agencies and on such third parties, dictates terms the agency's contract must contain, and sets a 72-hour breach clock on both sides.

Applicability to EdTech

• Every public school district is an "agency" — KRS 61.931(1)(d), "Every public school district in the Commonwealth of Kentucky" (§61.931(1)). Public postsecondary institutions are (1)(e).
• We are the "nonaffiliated third party": any person that has a contract or agreement with an agency and receives personal information from the agency pursuant to it (§61.931(5)). No size or volume threshold.
• "Personal information" here has a biometric limb at the identifier level, unlike most breach statutes: it means an individual's first name or first initial and last name; personal mark; or unique biometric or genetic print or image, in combination with one or more listed data elements (§61.931(6)). A biometric print or image can therefore stand in place of a name as the identifying half of the pair.
• The security duty applies to us directly, not only through the contract: "An agency or nonaffiliated third party that maintains or otherwise possesses personal information … shall implement, maintain, and update security procedures and practices, including taking any appropriate corrective action" (§61.932(1)(a)).
• The standard is set by the Kentucky Board of Education for school districts. A district's own procedures must accord with regulations promulgated by the Board (§61.932(1)(b)), and a supplier's contractual procedures must be "at least as stringent" as those (§61.932(2)(a)) — so the operative technical baseline is a Board regulation, not this statute. Those regulations are not extracted in this corpus; collect them when a Kentucky district question lands.
• Mandatory contract terms, for agreements executed or amended on or after 1 January 2015 (§61.932(2)(a)): the agency shall require the third party to implement, maintain and update security and breach-investigation procedures appropriate to the nature of the information and at least as stringent as the (1)(b) standard.
• A 72-hour clock on the vendor, from determination — and it carries a content requirement: notice to the agency must be given "in the most expedient time possible and without unreasonable delay but within seventy-two (72) hours of determination of a security breach", and "shall include all information the nonaffiliated third party has with regard to the security breach at the time of notification" (§61.932(2)(b)). Delay is permitted only where a law enforcement agency says notification would impede a criminal investigation or jeopardise homeland or national security.
• The agreement must apportion the cost of the response. §61.932(2)(b) requires agreements to "specify how the cost of the notification and investigation requirements under KRS 61.933 are to be apportioned when a security breach is suffered by the agency or nonaffiliated third party" — a commercial term with real money behind it, and one to settle before signature rather than during an incident.
• A federal-compliance shortcut exists, with a trap: a third party already required by federal law to investigate or notify may satisfy KRS 61.931–61.934 by giving the agency copies of all such reports and investigations — but not where the breach includes data elements outside the federal rules yet listed in §61.931(6)(a)–(f) (§61.932(1)(c)).

Contents

KRS 61.934, which applies the same scheme to the legislative and judicial branches, is not extracted — it cannot reach a school district or its suppliers.

Key obligations at a glance

• Implement, maintain and update security procedures and practices as a possessor of personal information — §61.932(1)(a).
• Meet procedures at least as stringent as the standard set for the agency, per the contract the agency must impose — §61.932(2)(a).
• Notify the agency within 72 hours of determination, with everything known at the time — §61.932(2)(b).
• Agency side, within 72 hours of determination or notification: notify the Kentucky State Police commissioner, the Auditor of Public Accounts, the Attorney General and — for a school district — the commissioner of the Kentucky Department of Education, and begin a prompt investigation — §61.933(1)(a).
• Agency side, on concluding the investigation where misuse has occurred or is reasonably likely: written notice to those officers within 48 hours, notice to affected individuals within 35 days, and — where more than 1,000 individuals are to be notified — 7 days' prior notice to the Kentucky Department of Education — §61.933(1)(b).

Enforcement

The Office of the Attorney General may bring an action in the Franklin Circuit Court against an agency or a nonaffiliated third party (or both) for injunctive relief, and "for other legal remedies against a nonaffiliated third party that is not an agency" — a remedy expressly available against a supplier but not against the agency itself. "Nothing in KRS 61.931 to 61.934 shall create a private right of action" (§61.933(6)). No civil-penalty ceiling is set. The other practical enforcement route for a supplier is the agency's contract, which §61.932(2)(a) requires the agency to write.

Licence

The corpus reproduces KRS 61.931 to 61.933 verbatim from the Kentucky Legislative Research Commission's per-section PDFs.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The per-section PDFs carry no copyright notice. The statutes pages (apps.legislature.ky.gov/law/statutes, read 2026-10-01) end with the footer "Copyright Kentucky Legislative Research Commission All rights Reserved". That footer can cover the site, but not the statutes the General Assembly enacts. The "Effective" and "History" lines, and any "Legislative Research Commission Note", are the work of the Legislative Research Commission, the General Assembly's own agency, made in the course of its legislative duties, which is the situation Georgia v. Public.Resource.Org held to be outside copyright.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Related

• Kentucky KRS 365.734 — the student-data companion, which binds cloud service providers directly
• Pennsylvania breach notification — the other vendor-side breach duty here, triggered by discovery rather than determination
• Texas school cybersecurity (§11.175) — the district-side duty with no fixed clock
• Puerto Rico Ley 40-2024 — government cybersecurity binding contractors, with a 48-hour clock
• NIST CSF — the framework these procedures are usually written against
• SDPC NDPA — the standard agreement into which the §61.932(2) terms have to fit

Sources

• Kentucky Legislative Research Commission — KRS 61.931 · KRS 61.932 · KRS 61.933