Law: Please note this State does not have a general privacy law in effect, you can visit USA State Law Tracker to monitor the progress of US State bills.

Regulator: The Kansas Attorney General ('AG')

Summary: Kansas does not currently have a general privacy act. However, Kansas does have privacy-related legislation in the form of the Kansas No-Call Act under §50-670 of Article 6 of Chapter 50 of the Kansas Statutes (Kan. Stat.), the Kansas Consumer Protection Act under §§50-623 to 50-643 of Article 6 of Chapter 50 of the Kan. Stat., and the data breach requirements of §50-7a01 et seq. of Article 7a of Chapter 50 of the Kansas Statutes (the Data Breach Requirements).

The Data Breach Requirements stipulate, among other things, that Kansas residents must be notified in the event of a breach by any person who conducts business in Kansas or a government, governmental subdivision, or agency that owns or licenses computerized data that includes personal information. They are enforced by the Kansas Attorney General (AG), despite there being no specific requirement to inform the AG of a breach. Moreover, there is a requirement to notify breaches affecting student data under §72-6318 of Article 63 of Chapter 72 of the Kan. Stat.

The No-Call Act and the Consumer Protection Act cover the creation and enforcement of a no-call list and the protection of Kansas consumers from deceptive or fraudulent business practices, respectively. The State has conducted multiple enforcement actions for violations of both laws, primarily concerning unsolicited telemarketing calls to consumers.

Furthermore, House Bill No. 2019 for an Act concerning information technology was signed by the Governor and came into effect on July 1, 2023. The Act lays down requirements for reporting significant cybersecurity incidents by entities maintaining personal information provided by the State of Kansas or using information systems operated by the same.

You can follow legislative developments in the US through the USA State Law Tracker.