{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Foulston Siefkin LLP","Daniel Buller"]
[null,null,"Sarah Otto"]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Kansas"]
["Key Legislation Overview"]
["1. What is the key legislation?","Several statutory sections address data-security and privacy obligations under Kansas law.  The primary section governing data-security and breach-notification obligations is Kan. Stat. Ann. § 50-7a01, et seq.\n\nThe Kansas Consumer Protection Act, Kan. Stat. Ann. § 50-6,139b, also imposes data-retention and related obligations on holders of “personal information.”\n"]
["2. What are the key decisions applying that legislation?","In re Target Corp. Customer Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1169 (D. Minn. 2014) denied a motion to dismiss a claim arising from Kan. Stat. Ann. § 50-7a01, et seq., noting that whether a private cause of action exists for breach-notification violations under the Kansas statute is ambiguous.\n"]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?","Kansas’s breach-notification law protects “personal information,” which is defined as a consumer’s first and last name or first initial and last name plus one or more of the following data elements: (i) Social Security number; (ii) driver’s license number or state identification card number; or (iii) financial account number or credit card number alone or in combination with any required security code, access code, or password that would permit access to a consumer’s financial account. Kan. Stat. Ann. § 50-7a01(g); Kan. Stat. Ann. § 50-6,139b(a)(3).  “Personal information” does not include “publicly available information that is lawfully made available to the general public from federal, state or local government records.”  Kan. Stat. Ann. § 50-7a01(g).  \n"]
["2. How is the defined data protected?","Personal information is protected by Kan. Stat. Ann. § 50-7a01, et seq., which imposes data-security and breach-notification obligations.\n\nThe Kansas Consumer Protection Act, Kan. Stat. Ann. § 50-6,139b, also imposes data-retention and related obligations on holders of “personal information.” The statute requires reasonable procedures and practices appropriate to the nature of the information, and the exercise reasonable care to protect the personal information from unauthorized access, use, modification, or disclosure. Kan. Stat. Ann. § 50-6,139b(b)(1).\n"]
["3. Who is subject to privacy obligations?","Kansas’s breach notification obligations apply to any “person that conducts business in [Kansas], or a government, governmental subdivision or agency that owns or licenses computerized data that includes personal information.”  Kan. Stat. Ann. § 50-7a02(a).  Kansas’s Consumer-Protection Act’s data-security obligations apply to all “holders” of personal information.  A “holder” is “a person who, in the ordinary course of business, collects, maintains or possesses, or causes to be collected, maintained or possessed, the personal information of any other person.  Kan. Stat. Ann. § 50-6,139b(a)(1).  \n"]
["4. How is “data processing” defined?","Not applicable.\n"]
["5. What are the principles applicable to personal data processing?","There are no specific regulations governing the collection of personal data in Kansas.  \n"]
["6. How is the processing of personal data regulated?","The use and disclosure of personal data is regulated in the following way: a holder of personal information must “maintain reasonable procedures and practices appropriate to the nature of the information, and exercise reasonable care to protect the personal information from unauthorized access, use modification or disclosure.”  Kan. Stat. Ann. 50-6,139b(b).\n"]
["7. How are storage, security and retention of personal data regulated?","Unless otherwise required by federal law or regulation, a holder of personal information must “take reasonable steps to destroy or arrange for the destruction of any records within such holder’s custody or control containing any person’s personal information when such holder no longer intends to maintain or possess such records.”  Kan. Stat. Ann. § 50-6,139b(b)(2).  The statute provides that destruction must be by “shredding, erasing or otherwise modifying the personal identifying information in the records to make it unreadable or undecipherable through any means.”  Id.\n"]
["8. What are the data subjects' rights under the data legislation?","Courts have noted that whether a private cause of action exists for breach-notification violations under Kan. Stat. Ann. § 50-7a01, et seq. is ambiguous.  See, e.g., In re Target Corp. Customer Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1169 (D. Minn. 2014).  \n"]
["9. What are the consent requirements for data subjects?","Not applicable.\n"]
["10. How is authorization for use of data handled?","Not applicable.\n"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?","The statute does not specifically regulate cross-border data transfers; however, the holder of personal information must implement and maintain reasonable procedures and practices appropriate to the nature of the information, and exercise reasonable care to protect personal information from unauthorized access, use, modification, or disclosure. Kan. Stat. Ann. § 50-6,139b(b)(1).\n"]
["12. How are data \"incidents\" and \"breaches\" defined?","Under K.S.A. § 50-7a01(h), “Security breach” means the unauthorized access and acquisition of unencrypted or unredacted computerized data that compromises the security, confidentiality or integrity of personal information maintained by an individual or a commercial entity and that causes, or such individual or entity reasonably believes has caused or will cause, identity theft to any consumer. Good faith acquisition of personal information by an employee or agent of an individual or a commercial entity for the purposes of the individual or the commercial entity is not a breach of the security of the system, provided that the personal information is not used for or is not subject to further unauthorized disclosure.\n"]
["13. Are there any notification requirements for incidents and/or data breaches?","If, after a prompt and reasonable investigation, the owner or licensor of personal information determines that the data has been accessed and acquired and is reasonably likely to be “misused,” the breached entity must give “notice as soon as possible to the affected Kansas resident.  Notice must be made in the most expedient time possible and without unreasonable delay,” consistent with law-enforcement needs. Kan. Stat. Ann. § 50-7a02(a). The notice must be given to all affected Kansas residents. Id. An individual or commercial entity that maintains data that includes personal information that the individual or entity does not own or license must notify the owner or licensee of the information following a data breach if the personal information is reasonably believed to have been accessed and acquired by an unauthorized person. Kan. Stat. Ann § 50-7a02(b). See also Kan. Stat. Ann. § 72-6318 for similar notification obligations relating to student data. See also Kan. Stat. Ann. § 75-7240 for responsibilities of Kansas executive branch agency heads.\n"]
["14. Who is/are the privacy regulator(s)?","The Kansas Attorney General and the Kansas Insurance Commissioner.  The Kansas Attorney General has exclusive authority to bring an action for violation of data-security obligations set forth in Kan. Stat. Ann. § 50-6,139b, et seq.  Except for violations by insurance companies, the Kansas Attorney General is also empowered, though not exclusively, to bring actions for breach-notification violations under Kan. Stat. Ann. § 50-7a01, et seq.\n"]
["15. What are the consequences of a data breach?","For violations of Kansas’s breach-notification law, the Attorney General may bring an action in law or in equity “and for other relief that may be appropriate.” Kan. Stat. Ann. § 50-7a02(g). This remedy is “not-exclusive” and may allow for private causes of action to address violations. See id. See also In re Target Corp. Customer Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1169 (D. Minn. 2014). Each record that is “not destroyed” in compliance with Kansas’s data-retention law is “a separate unconscionable act” under Kansas’s Consumer-Protection Act and subject to civil penalties under that section. Kan. Stat. Ann. § 50-6,139b(d).\n"]
["16. How is electronic marketing regulated?","Kansas has adopted the Commercial Electronic Mail Act, which prohibits the transmission of certain forms of “commercial electronic mail” from either a computer located in Kansas or to a resident the sender knows is a Kansas resident. Kan. Stat. Ann. § 50-6,107(c).  Violators of this section are subject to civil penalties of “not less than USD $500 nor more than USD $10,000 for each such violation.”  Kan. Stat. Ann. § 50-6,107(j).\n"]
["17.\tAre there sector-specific or industry-specific privacy requirements?","Healthcare industry-specific privacy requirements are set forth in the Kansas Health Information Technology and Exchange Act, Kan. Stat. Ann. § 65-6821, et seq., which protects health information, regulates proper safeguarding of protected health information, and regulates the use and disclosure of protected health information. \n\nStudent data privacy requirements are set forth in K.S.A. 72-6312 through 72-6320, which regulates the disclosure of student data by educational agencies. \n\nKansas law protects social security numbers. Kan. Stat. Ann. § 75-3520(a)(1). Insurance companies and educational institutions are prohibited from using social security numbers as personal identifiers. Kan. Stat. Ann. § 40-2425 (insurance companies); § 76-768 (educational institutions).\n\nThe Kansas Constitution protects against unreasonable government searches. See Kansas Const., Bill of Rights, § 15.\n"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?","Not applicable.\n"]
["19.\tWhat are the record-keeping and documentation obligations?","Employers have certain record-keeping obligations for employee records under Kan. Stat. Ann. § 44-1209. \n"]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?","Not applicable.\n"]
["21.\tWhat are the requirements for third-party vendor management and data sharing?","Not applicable.\n"]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?","The Kansas Attorney General has exclusive authority to bring an action for violation of data-security obligations set forth in Kan. Stat. Ann. § 50-6,139b, et seq.  Except for violations by insurance companies, the Kansas Attorney General is also empowered, though not exclusively, to bring actions for breach-notification violations under Kan. Stat. Ann. § 50-7a01, et seq.  For breach-notification violations by an insurance company, enforcement authority is vested solely in the Kansas Insurance Commissioner. Kan. Stat. Ann. § 50-7a02(h). Courts have noted that whether a private cause of action exists for breach-notification violations under Kan. Stat. Ann. § 50-7a01, et seq. is ambiguous.  See, e.g., In re Target Corp. Customer Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1169 (D. Minn. 2014) (denying a motion to dismiss).  See also our answer to “What are the consequences of a data breach?”\n"]
["23.\tWhat are the ongoing compliance and audit requirements?","Not applicable.\n"]
["24. Are there any recent developments or expected reforms?","Not applicable.\n"]