Kentucky Consumer Data Protection Act KY-CDPA-Data-Protection-Assessment-DPA-Targeted-Advertising-Sale-Sensitive-Profiling-Substantial-Risk: Kentucky CDPA Data Protection Assessment (DPA) + Section 6 + Targeted Advertising + Sale + Sensitive Data + Profiling Substantial Injury + Maintained Records + Attorney General Access + 4 Categories Requiring DPA + Risk-Benefit Analysis

Section 6 of Kentucky CDPA establishes the Data Protection Assessment (DPA) requirement for high-risk processing activities. (1) Section 6 DPA Required Activities (4 Categories): (a) Processing personal data for targeted advertising; (b) Sale of personal data; (c) Processing sensitive data; (d) Processing personal data for profiling where profiling presents reasonable foreseeable risk of (i) substantial injury (including financial + reputational + physical + economic + emotional harm); (ii) deceptive practices; (iii) intrusion upon solitude or seclusion. (2) Section 6 DPA Methodology: (a) Identify processing activity; (b) Assess risks of processing including likelihood + severity; (c) Identify benefits of processing including legitimate business interests; (d) Risk-Benefit balancing analysis; (e) Identify safeguards + mitigations; (f) Document conclusions; (g) Periodic review + update; (h) Available to Attorney General upon request. (3) Section 6 DPA Content Requirements: (a) Description of processing activity; (b) Categories of personal data involved; (c) Purposes for processing; (d) Stakeholder analysis (consumers + non-users); (e) Likelihood of harm assessment; (f) Severity of harm assessment; (g) Benefits to consumer + controller + third party + society; (h) Safeguards employed (encryption + access control + minimization + retention limits + transparency); (i) Risk-benefit conclusion; (j) Decision (proceed + modify + not proceed); (k) Review schedule. (4) Section 6 DPA Documentation Requirements: (a) Written record; (b) Approved by controller's privacy lead; (c) Retained for compliance evidence; (d) Made available to Attorney General; (e) Confidential business information + trade secret protections may apply; (f) Multi-state DPA harmonization (VCDPA + Colorado CPA + Connecticut + Tennessee DPA standards similar). (5) DPA Process Implementation: (a) DPIA Trigger - new processing activity + material change to existing + new vendor with data access + new technology deployment + new processing purpose; (b) Stakeholder consultation - privacy professionals + business + legal + DPO + technical security + ethics committee; (c) Risk assessment frameworks - NIST Privacy Risk Assessment Methodology + ENISA + ISO/IEC 29134; (d) Documentation - DPA template + risk register + decision log + action items; (e) Review - annual + ad-hoc on material changes; (f) Audit trail. (6) Profiling Specific Considerations: (a) Section 2 Profiling definition - automated processing of personal data to evaluate, analyze, or predict personal aspects (economic situation + health + personal preferences + interests + reliability + behavior + location + movements); (b) Legal/significant effects per Section 2 (Decisions that produce legal or similarly significant effects) - housing + lending + insurance + education + criminal justice + employment + healthcare + essential goods/services; (c) Section 6 DPA required if substantial injury risk; (d) Right to Opt Out per Section 3; (e) AI/ML systems profiling - emerging considerations; (f) Generative AI considerations. (7) Sensitive Data Processing DPA: (a) Specifically required for sensitive data processing; (b) Per-category DPA recommended; (c) Linkage with consent management; (d) Enhanced safeguards documentation; (e) Vendor + processor specific assessments. (8) Targeted Advertising Specific: (a) Section 2 Targeted Advertising definition - displaying advertisements based on personal data obtained or inferred over time about consumer's activities to predict preferences/interests; (b) EXCLUDES advertisements based on consumer's activities within controller's own/affiliated websites + first-party context + non-targeted advertising; (c) DPA required where qualifies as targeted advertising; (d) Children's targeted advertising prohibited. (9) Sale of Personal Data DPA: (a) Sale per Section 2 definition; (b) Categories of sale considered; (c) Consumer Opt-Out mechanism documented; (d) Recipients + downstream chain; (e) Cure period considerations. (10) DPA AG Access: (a) Attorney General may request DPA upon investigation; (b) Confidentiality protections - work product privilege + trade secret + business confidential; (c) Cooperation expectation; (d) Failure to provide DPA exposes controller to additional risk. (11) Multi-State DPA Standards: (a) VCDPA Virginia 9-CHAPTER 51 4 categories essentially identical; (b) Colorado CPA + Connecticut CTDPA similar; (c) Tennessee TIPA + Iowa ICDPA + Indiana CDPA + Texas similar; (d) Single multi-state DPA approach possible; (e) Confidentiality varies. (12) Penalties for DPA Failures: (a) Section 9 AG enforcement; (b) 30-day cure period; (c) Civil penalty up to USD 7,500 per violation; (d) Pattern of DPA failures increases exposure. Coordinates with VCDPA Virginia + Indiana CDPA + Iowa ICDPA + Connecticut CTDPA + Colorado CPA + Utah UCPA + CCPA/CPRA California + Tennessee TIPA + NIST Privacy Risk Assessment Methodology + ENISA + ISO/IEC 29134 + IAB TCF v2.2 + COPPA + AI/ML governance + AI Bill of Rights. Kentucky CDPA DPA + Section 6 applies.