─ Protection of Personal Information Security and Breach Investigation Procedures and Practices Act. 1. Vendors that receive Personal Information as defined by and in accordance with Kentucky’s Personal Information Security and Breach Investigation Procedures and Practices Act, KRS 61.931, et seq., (the “Act”), shall secure and protect the Personal Information by, without limitation, complying with all requirements applicable to non-affiliated third parties set forth in the Act.
─ Protection of Personal Information Security and Breach Investigation Procedures and Practices Act. Contractors that receive Personal Information as defined by and in accordance with Kentucky’s Personal Information Security and Breach Investigation Procedures and Practices Act, KRS 61.931, KRS 61.932, KRS 61.933, and KRS 61.934, (the “Act”), shall secure and protect the Personal Information by, without limitation, complying with all requirements applicable to non-affiliated third parties set forth in the Act. The Contractor hereby agrees to cooperate with the Commonwealth in complying with the response, mitigation, correction, investigation, and notification requirements of the Act. The Contractor shall notify as soon as possible, but not to exceed seventy-two (72) hours, the contracting agency, the Commissioner of the Kentucky State Police, the Auditor of Public Accounts, and the Commonwealth Office of Technology of a determination of or knowledge of a breach, unless the exception set forth in KRS 61.932(2)(b)2 applies and the Contractor abides by the requirements set forth in that exception. If the agency is a unit of government listed in KRS 61.931(1)(b), the Contractor shall notify the Commissioner of the Department of Local Government in the same manner as above. If the agency is a public school district listed in KRS 61.931(1)(d), the Contractor shall notify the Commissioner of the Department of Education in the same manner as above. If the agency is an educational entity listed under KRS 61.931(1)(e), the Contractor shall notify the Council on Postsecondary Education in the same manner as above. Notification shall be in writing on a form developed by the Commonwealth Office of Technology. The Contractor hereby agrees that the Commonwealth may withhold payment(s) owed to the Contractor for any violation of the Identity Theft Prevention Reporting Requirements. The Contractor hereby agrees to undertake a prompt and reasonable investigation of any breach as required by KRS 61.933. Upon conclusion of an investigation of a security breach of Personal Information as required by KRS 61.933, the Contractor hereby agrees to an apportionment of the costs of the notification, investigation, and mitigation of the security breach. In accordance with KRS 61.932(2)(a) the Contractor shall implement, maintain, and update security and breach investigation procedures that are appropriate to the nature of the information disclosed, that are at least as stringent as the security and breach investigation procedures and practices established by the Commonwealth Office o...
