Kentucky Consumer Data Protection Act KY-CDPA-Consumer-Rights-Section3-Access-Correction-Deletion-Portability-Object-Profiling-45-Days: Kentucky CDPA Consumer Rights + Section 3 + Right of Access + Correction + Deletion + Portability + Right to Object to Sale/Targeted Advertising/Profiling + 45-Day Response Window + Single 45-Day Extension + Free for First Request
Section 3 of Kentucky CDPA establishes the comprehensive consumer rights framework + closely modelled on VCDPA Virginia template. (1) Section 3(1) Five Consumer Rights: (a) Right of Access - confirm whether processing personal data + access copy in portable + readily usable format; (b) Right of Correction - correct inaccuracies based on consumer's request; (c) Right of Deletion - request deletion of personal data provided by or obtained about consumer; (d) Right of Portability - obtain copy of personal data previously provided to controller in portable + readily usable format (where technically feasible); (e) Right to Opt Out of (i) targeted advertising; (ii) sale of personal data; (iii) profiling for decisions that produce legal or similarly significant effects. (2) Section 3(2) Response Window: (a) Authenticated request - controller must respond within 45 CALENDAR DAYS of receipt; (b) One single 45-day extension permitted for complex requests; (c) Total maximum 90 days; (d) Notification to consumer of extension with reasons; (e) Information to be provided about request status. (3) Section 3 Free of Charge: (a) First request per consumer per 12-month period - FREE; (b) Manifestly unfounded or excessive requests - reasonable fee permitted; (c) Refusal allowed if request manifestly unfounded; (d) Refusal must be reasoned + appealable. (4) Section 3 Authenticated Request: (a) Authentication required to prevent fraudulent requests; (b) Reasonable authentication means - account login + email verification + KBA Knowledge-Based Authentication + government ID match; (c) Proportionate to risk of unauthorized access; (d) Authentication cannot be unduly burdensome; (e) Privacy-preserving authentication preferred. (5) Section 3 Rights Request Mechanism: (a) Controller must designate clear + conspicuous mechanism; (b) Web portal + email + phone number + form; (c) Mechanism in plain English; (d) Accessibility for disability per ADA + WCAG 2.2; (e) Mobile-friendly; (f) Privacy professional support. (6) Section 3 Refusal Grounds (Limited): (a) Manifestly unfounded + excessive frequency; (b) Threat to security of personal data; (c) Threat to other's rights; (d) State secret or law enforcement constraints; (e) Cannot verify consumer identity; (f) Refusal must provide reasoned response. (7) Section 3 Appeals Process: (a) Consumer right to appeal controller decision; (b) Appeals process must be conspicuously available; (c) 60-day appeal response window; (d) Reasoned response required for appeals; (e) Online mechanism for appeals encouraged; (f) Plain language explanation. (8) Section 3 Specific Rights Detailed: (a) Right of Access - all personal data + categories + sources + recipients + purposes + retention; (b) Right of Correction - factual inaccuracies + technical errors; (c) Right of Deletion - data provided BY consumer + data obtained ABOUT consumer (broader than some states); (d) Right of Portability - structured + commonly used + machine-readable + automated where feasible; (e) Right to Opt Out - immediate effect + cessation of processing. (9) Universal Opt-Out Mechanism (UOOM) (Section 4(3) emerging): (a) Recognized Universal Opt-Out Mechanism (e.g. GPC Global Privacy Control + emerging others); (b) Browser-level signal recognition; (c) Required to honor for targeted advertising + sale; (d) Required to honor for profiling (emerging); (e) Discoverability + verification requirements; (f) Updated annually with recognized mechanisms (Attorney General); (g) Reflects Colorado CPA + California CCPA UOOM models. (10) Children's Specific Rights (Under 13): (a) Parental request rights; (b) COPPA-aligned mechanisms; (c) Parental consent rescission; (d) Special considerations for minor data. (11) Multi-State Rights Request Coordination: (a) Multi-state rights request standardization; (b) Common request portal across states; (c) Per-state response timeline tracking; (d) Multi-state authentication standardization; (e) Privacy engineering for multi-state DSAR. (12) Penalties for Rights Violations: (a) Section 9 AG enforcement; (b) 30-day cure period; (c) Civil penalty up to USD 7,500 per violation. Coordinates with VCDPA Virginia + Indiana CDPA + Iowa ICDPA + Connecticut CTDPA + Colorado CPA + Utah UCPA + CCPA/CPRA California + Tennessee TIPA + ADPPA federal proposal + GPC Global Privacy Control + IAB TCF v2.2 + COPPA + ADA + WCAG 2.2 + NIST Privacy Framework + multi-state DSAR standards. Kentucky CDPA Consumer Rights + Section 3 applies.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 201 controls across 53 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
DOM172-Data-Subject-ARCO-Rights-Habeas-Data-Action-Constitutional-Article-70-Access-Rectification-Cancellation-Opposition Dominican Republic Law 172-13 ARCO Rights + Habeas Data Action + Constitutional Article 70
DOM172-Lawful-Basis-Consent-Notice-Information-Duty-Articles-4-12-Quality-Principle-Purpose-Limitation-Minimisation Dominican Republic Law 172-13 Lawful Basis + Consent + Notice + Information Duty + Articles 4-12