Timing of Consumer Notification
“Most expedient time possible and without unreasonable delay.”
Method of Notice
Mail. Email permitted if complies with E-SIGN.
Breach Definition
Unauthorized access and acquisition of unencrypted or unredacted data that compromises security, confidentiality or integrity of personal information maintained by individual or commercial entity and that causes, or such individual or entity reasonably believes has caused or will cause, identity theft to any consumer.
PII Definition
Consumer's first name or first initial and last name in combination with any of these, when not encrypted or redacted:
  1. Social Security number;
  2. Driver's license number or state identification card number; or
  3. Financial account number, or credit or debit card number, alone or in combination with required security code, access code or password that would permit access to consumer's financial account.
Third Party Notice
If individual or entity maintains computerized data that includes personally identifiable that individual or entity does not own, must notify owner or licensee of breach following discovery.
How to Notify
No specific content requirement.
Substitute Notice
(a) email if individual or commercial entity has email addresses for affected class of consumers;
(b) conspicuous posting of notice on website of individual or commercial entity if it maintains one; and (c) notification to major statewide media.
Credit Monitoring
Not required.
When to Notify Credit Agencies
If more than 1,000 Kansas consumers must be notified.
This State's Law
Person or business shall take reasonable steps to destroy or arrange for destruction of customer's records within its custody or control containing personal information that is no longer to be retained by shredding, erasing or otherwise modifying to make unreadable or undecipherable.
State Government Agency Notification Required
Not required.