Data breach notification
Kentucky's breach notice rules are in KRS 365.732.
It leans on a single question: did the breach cause, or is it believed to cause, identity theft or fraud?
Kentucky defines a breach as one that actually causes, or leads the information holder to reasonably believe has caused or will cause, identity theft or fraud against any resident of the Commonwealth.
The duty then runs to any Kentucky resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Those elements count when the name or element is not redacted.
Two conditions narrow the list. The name or data element must not be redacted, and the duty to residents covers unencrypted personal information that was, or is reasonably believed to have been, acquired by an unauthorized person. Redacted or encrypted data on its own sits outside that wording.
The disclosure shall be made in the most expedient time possible and without unreasonable delay. Kentucky gives no number of days.
No regulator notice appears in KRS 365.732, but more than 1,000 persons triggers notice to the nationwide consumer reporting agencies.
Entities subject to GLBA or HIPAA are excluded from the section.
If something goes wrong with a shared folder, being able to list exactly who opened what is the quickest place to begin.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
That watermark is a per-room setting and is on by default. Recipients confirm their email with a six-digit code and need no account, and groups see only their folders. The chained log exports as CSV.
Checked against Kentucky's published law on November 2, 2026. This is general information, not legal advice.
