Kentucky Consumer Data Protection Act
KY CDPA Sensitive Data + Consent

Kentucky Consumer Data Protection Act KY-CDPA-Sensitive-Data-Affirmative-Consent-Race-Religious-Health-Genetic-Biometric-Children-Citizenship: Kentucky CDPA Sensitive Data + Affirmative Consent + Race/Ethnicity + Religious + Mental/Physical Health + Sexual Orientation + Citizenship/Immigration + Genetic + Biometric + Children's Data + Precise Geolocation (1,750 ft) + Section 4 Heightened Consent Standard

What does KY-CDPA-Sensitive-Data-Affirmative-Consent-Race-Religious-Health-Genetic-Biometric-Children-Citizenship require?

Section 4(4)(a) of Kentucky CDPA establishes the heightened consent requirement for sensitive data processing. (1) Section 2 Sensitive Data Definition - 8 Categories: (a) Racial or ethnic origin; (b) Religious beliefs; (c) Mental or physical health diagnosis; (d) Sexual orientation; (e) Citizenship or immigration status; (f) Genetic or biometric data processed for identification purposes; (g) Children's data (data of consumers known to be under 13); (h) Precise geolocation data - within 1,750 feet (approximately 1/3 mile - critical for location tracking + connected vehicles + retail analytics). (2) Section 4(4) Heightened Consent Standard: (a) Affirmative consent required BEFORE processing sensitive data; (b) Clear affirmative act + specific + informed + unambiguous; (c) Written or electronic equivalent; (d) Withdrawable at any time; (e) Documented + audit trail; (f) Reaffirmation for new purposes; (g) Pre-ticked boxes + silence + inactivity do NOT constitute consent. (3) Genetic Data Specific: (a) Heritability affecting family members; (b) Bioethics considerations; (c) Genetic testing services + ancestry; (d) Health insurance + GINA Genetic Information Nondiscrimination Act intersection; (e) DNA forensic considerations; (f) Pharmacogenomics. (4) Biometric Data Specific (Identification Purpose): (a) Used for identification of specific individual; (b) Excludes physical/digital photographs unless for ID; (c) Excludes audio/video unless for ID; (d) HIPAA + healthcare exception; (e) Fingerprint + facial recognition + voice + iris + retina; (f) Behavioural biometrics; (g) Mobile device biometrics; (h) Banking biometric authentication. (5) Children's Data Specific (Under 13): (a) COPPA Children's Online Privacy Protection Act intersection; (b) Verifiable parental consent required; (c) FTC COPPA Safe Harbor programs; (d) NO direct marketing to children; (e) NO targeted advertising to children; (f) NO profiling of children for decisions; (g) Education sector + FERPA considerations; (h) Children's Code emerging; (i) Age verification mechanisms. (6) Mental/Physical Health Diagnosis: (a) Distinguished from general wellness data; (b) Mental health + substance abuse + reproductive health + chronic conditions + disability; (c) Telemedicine + digital therapeutics + mental health apps; (d) HIPAA exempt for HIPAA-covered entities + business associates; (e) FDA Software as Medical Device (SaMD) considerations; (f) Insurance + ADA discrimination considerations. (7) Religious Beliefs: (a) Religious affiliation + practice + belief; (b) Religious dietary + clothing + ritual observance; (c) Religious community membership; (d) First Amendment + Religious Freedom Restoration Act considerations. (8) Sexual Orientation: (a) LGBTQ+ status disclosure; (b) Workplace + housing + service discrimination concerns; (c) Title VII employment intersection; (d) State LGBTQ+ protections vary; (e) Sensitive context - dating apps + healthcare + employment. (9) Citizenship/Immigration Status: (a) Native + Naturalized US citizen + LPR Lawful Permanent Resident + visa status + asylum/refugee + undocumented; (b) Employment + housing discrimination concerns; (c) Immigration enforcement + cooperation considerations; (d) Sanctuary city considerations; (e) E-Verify + I-9 employment context. (10) Precise Geolocation (1,750 ft): (a) GPS + cell tower triangulation + Wi-Fi positioning + Bluetooth beacon; (b) Mobile app location + advertising; (c) Connected vehicle + telematics; (d) Retail analytics + customer tracking; (e) Behavioral profiling; (f) Surveillance concerns. (11) Sensitive Data Processing Practices: (a) Data classification + tagging; (b) Access control + role-based + need-to-know; (c) Encryption + segregation + masking; (d) Audit logging + monitoring; (e) Vendor due diligence + processor obligations; (f) Privacy Impact Assessment (Section 6 DPA); (g) Data subject rights enhanced for sensitive data. (12) Penalties for Sensitive Data Violations: (a) Section 9 AG enforcement; (b) 30-day cure period; (c) Civil penalty up to USD 7,500 per violation; (d) Aggregation possible (multiple consumers + multiple categories); (e) Class-action-like exposure absent (no PRA). Coordinates with VCDPA Virginia + Indiana CDPA + Iowa ICDPA + Connecticut CTDPA + Colorado CPA + Utah UCPA + CCPA/CPRA California + Tennessee TIPA + COPPA Children's Online Privacy Protection Act + GINA Genetic Information Nondiscrimination Act + HIPAA + Title VII + ADA + FERPA + FTC Health Breach Notification Rule + State LGBTQ+ Protections + Religious Freedom Restoration Act + First Amendment + Immigration laws. Kentucky CDPA Sensitive Data + Section 4(4) + 8 Categories applies.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 163 controls across 64 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FFIEC IT Examination Handbook · 5 controls

  • FFIEC-08 Application security controls
  • FFIEC-09 Encryption and key management
  • FFIEC-23 Regulatory reporting requirements
  • FFIEC-24 Customer notification procedures
  • FFIEC-25 Post-incident review and improvement

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 5 controls

APPI · 4 controls

  • APPI-A31 Provision of Personally Referable Information
  • APPI-A34 Request for Correction, Addition or Deletion
  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A43 Preparation of Anonymized Personal Information

BSI IT-Grundschutz · 4 controls

  • BSI-08 Cryptographic protection of data
  • BSI-18 Incident response planning and testing
  • BSI-20 Incident reporting and notification
  • BSI-21 Forensic analysis capabilities

Bahrain PDPL · 4 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 4 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)
  • UAE-PDPL-Art.25_26_27_28_29 UAE Data Office establishment, powers, penalties, complaints (UAE PDPL Articles 25-29)
  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

ISO/IEC 27043:2015 · 4 controls

  • ISO27043-17 Encryption of data at rest
  • ISO27043-18 Encryption of data in transit
  • ISO27043-19 Certificate management
  • ISO27043-20 Key lifecycle management

ISO/SAE 21434 · 4 controls

  • ISO21434-16 Cryptographic policy and key management
  • ISO21434-17 Encryption of data at rest
  • ISO21434-18 Encryption of data in transit
  • ISO21434-19 Certificate management

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) · 4 controls

  • PQC-2 FIPS 203 ML-KEM Implementation - Module-Lattice Key-Encapsulation Mechanism
  • PQC-5 Cryptographic Inventory and PQC Migration Roadmap
  • PQC-7 FIPS Validated Modules, HSM Readiness, and Algorithm Validation
  • PQC-8 Implementation Requirements - RNG, Side-Channel, Key Management, Operations, Incident Response

API 1164 · 3 controls

  • API1164-17 Wireless and Field Communications
  • API1164-18 Field Device Security
  • API1164-19 Safety Instrumented Systems Interface

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-17 TLS encryption between email servers (Limited)
  • ASD37-31 Hunt to discover incidents (Very Good)
  • ASD37-33 Capture network traffic (Limited)

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

EASA Part-IS - Information Security in Aviation · 3 controls

  • IS.AR.215 Information Security Incident Response
  • IS.D.OR.225 External Reporting of Information Security Events
  • IS.I.OR.225 External Reporting

FedRAMP Rev 5 · 3 controls

  • FEDRAMP-SC-13 Cryptographic Protection
  • FEDRAMP-SC-28 Protection of Information at Rest
  • FEDRAMP-SC-8 Transmission Confidentiality and Integrity

IEC 62443 · 3 controls

  • IEC62443-16 Incident response plan for operational disruptions
  • IEC62443-17 Recovery plan for critical systems
  • IEC62443-20 Exercises and drills for OT incidents

ISO 22320:2018 · 3 controls

  • ISO-22320-5.2 Incident management process
  • ISO-22320-B Annex B: Incident management plan structure
  • ISO-22320-C Annex C: Incident management task examples

ISO/IEC 23837:2023 · 3 controls

  • 23837-1.2 Normative references
  • 23837-1.5.2 Cryptographic module requirements
  • 23837-1.5.3 Network device testing requirements

ISO/IEC 27019:2024 · 3 controls

  • ISO27019-16 Incident response plan for operational disruptions
  • ISO27019-18 Reporting obligations to authorities
  • ISO27019-20 Exercises and drills for OT incidents

ISO/IEC 27400:2022 · 3 controls

  • 27400-6.2 Device Identity and Authentication
  • 27400-6.3 Secure Update Mechanism
  • 27400-6.5 Security monitoring and incident response

OWASP DevSecOps Maturity Model (DSOMM) · 3 controls

  • DSOMM-1 Culture, Organization, Education, and Governance
  • DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling
  • DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing

OWASP Top 10:2025 · 3 controls

  • OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management
  • OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse)
  • OWASPTOP10-9 A09:2025 Security Logging and Monitoring Failures

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 3 controls

  • IM8-CLD.2 Cloud Security Controls
  • IM8-DSS.3 Secure Development Practices
  • IM8-RES.3 Incident Response

APRA CPS 234 · 2 controls

  • CPS234-21 Implementation of Information Security Controls
  • CPS234-25 Internal Audit Review of Information Security Controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

  • AWWA-3.2 Remote Access Security
  • AWWA-3.4 Encryption and Data Protection

FBI CJIS Security Policy · 2 controls

  • CJIS-8 Media Protection
  • CJIS-9 System and Communications Protection

FTC GLBA Safeguards Rule (16 CFR Part 314) · 2 controls

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))
  • FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j))

ISO 27799:2025 · 2 controls

  • ISO27799-02 ePHI encryption at rest and in transit
  • ISO27799-16 Transmission security and encryption

ISO/IEC 27010:2015 · 2 controls

  • 27010-10.1 Cryptographic Protection
  • 27010-16.1 Continuity of Sharing

ISO/IEC 30111:2019 · 2 controls

  • 30111-3 Terms and definitions
  • 30111-5.2 Vulnerability handling team

OWASP ASVS · 2 controls

Privacy Act 1988 (Australia) · 2 controls

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information
  • AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response

South Korea ISMS-P · 2 controls

  • ISMSP-SYS-02 Encryption Implementation
  • ISMSP-SYS-05 Incident Response

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • D.2 Incident Reporting

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 2 controls

  • CYB-5 Cyber Incident Response Plan
  • USMTSA-2 Cybersecurity Assessment and CSO Designation

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-13 Board Accountability for Operational Risk Management

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.7 Emergency and Incident Response

Annex 11 to EU GMP - Computerised Systems · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-12 Deploys Through Policies and Procedures

Canada ITSG-33 - IT Security Risk Management · 1 control

  • CA-ITSG33-SC-01 Security Control Catalogue

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) · 1 control

  • LOPDP-EC-Security-Processor-Breach-Notification-Articles-37-45-Encryption-72-Hour-SPDP-Notification-CSIRT Ecuador LOPDP Security + Processor + Breach Notification + Articles 37-45 + 72-Hour

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D5-1 Incident planning and strategy

FIDO2 / WebAuthn · 1 control

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-9 Cyber security key management

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PC-04 Supply Chain Continuity Planning

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-11 Incident management

ISO/IEC 27011:2024 · 1 control

  • 27011-8.3 Cryptography and key management

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 1 control

  • 29115-7.4 Level of Assurance 4 (LoA4)

ITIL 4 · 1 control

  • ITIL4-11 Incident management

Law No. 172-13 on the Protection of Personal Data · 1 control

  • DOM172-Security-Measures-Article-25-Encryption-Pseudonymization-Access-Control-Incident-Handling-Breach-Notification-Article-22 Dominican Republic Law 172-13 Security Measures + Article 25 + Encryption + Breach Notification

MITRE D3FEND · 1 control

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

OWASP API Security Top 10 - 2023 · 1 control

  • OWASPAPI-6 Security Misconfiguration and Secure API Design

Pakistan Personal Data Protection Bill 2023 · 1 control

  • PAKPDPB-5 Security of Processing and Personal Data Breach Notification

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Singapore Cybersecurity Act 2018 · 1 control

  • SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

Turkey KVKK · 1 control

  • TURKEYKVKK-2 Information Notice and Data Subject Rights

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 1 control

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content)

Voluntary Principles on Security and Human Rights (VPs) · 1 control

  • VPSHR-3 Implementation Guidance and Reporting

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 163 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Kentucky Consumer Data Protection Act controls