Law note · Kansas
Kansas Breach Notification Act, notice of security breach
A person conducting business in Kansas, or a government, governmental subdivision, or agency that owns or licenses computerized personal information, must conduct a good-faith, reasonable, and prompt investigation on learning of a suspected breach and, if misuse occurred or is reasonably likely, give notice to the affected Kansas resident as soon as possible, in the most expedient time possible and without unreasonable delay.
The codified text sets no fixed numeric deadline, despite secondary-source claims of a 45-day figure, which does not appear anywhere in K.S.A. 50-7a02. Personal information is a name combined with a Social Security number, driver's license or state ID number, or financial account or card number with access credentials, and excludes publicly available government-record information; it does not reach biometric identifiers.
Notice to each nationwide consumer reporting agency is required when more than 1,000 consumers are affected at one time. Enacted 2006 (L. 2006, ch. 149, sec. 4); no separate effective date beyond that original enactment is recorded here.
What it asks of an app
- Conduct a good-faith, reasonable, and prompt investigation on becoming aware of a breach of system security involving personal information about a Kansas resident.
- Give notice to each affected Kansas resident as soon as possible, in the most expedient time possible and without unreasonable delay, if the investigation shows misuse occurred or is reasonably likely. There is no fixed numeric deadline in the statute; do not rely on a 45-day figure some secondary sources describe.
- Notify each nationwide consumer reporting agency if more than 1,000 Kansas consumers are affected by one breach.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Kansas statute text, Kansas Statutes Annotated, Office of Revisor of Statutes