If notification is required for more than 1,000 consumers, the breached Organization must also notify all consumer reporting agencies and credit bureaus.

Breach notification without delay must be given to any resident of Kentucky affected by a breach that includes personal information.

Organizations may be fined or penalized for Vendor violations. Consumers may bring an action to recover damages for violations of the data destruction requirements.

Additional requirements may apply to student data and cloud computing service providers.

Organizations and Vendors in the business of destroying records must have measures in place for the secure destruction of records containing personal information so the records are unreadable or indecipherable.

Vendors must notify Organizations as soon as possible after the discovery of a breach or suspected breach. The Organization will be responsible to complete any required regulatory reporting and consumer notification.