Kansas Privacy Protection Act (Senate Bill 365)
Proposed legislation to establish comprehensive consumer privacy rights and business obligations. Would require businesses to provide privacy notices, honor consumer rights requests, and implement reasonable security measures. Includes provisions for enforcement by the attorney general.
| Jurisdiction | Kansas |
|---|---|
| Category | Privacy & Data Protection |
| Status | Proposed |
| Latest development |
Analysis
Key Requirements
The proposed Kansas Privacy Protection Act (Senate Bill 365) would establish comprehensive consumer privacy rights and business obligations:
- Privacy Notices: Businesses must provide clear privacy notices detailing data collection and use practices, as outlined in Section 3 of SB 365
- Consumer Rights: Consumers would have the right to access, correct, delete, and opt-out of the sale of their personal information, as specified in Section 4 of the bill
- Data Security: Organizations must implement and maintain reasonable security procedures to protect personal data, as required by Section 5 of SB 365
- Consent Requirements: Businesses must obtain affirmative consent before collecting or processing sensitive personal information, according to Section 6 of the proposed legislation
- Data Protection Assessments: Certain data processing activities would require conducting data protection impact assessments, as outlined in Section 7 of SB 365
Compliance Challenges
Organizations may face several challenges in complying with the proposed Kansas Privacy Protection Act:
- Data Mapping and Inventory: Identifying and categorizing all personal data across systems can be complex, as highlighted in IAPP's Privacy Program Management guide
- Consumer Request Management: Efficiently handling consumer rights requests within required timeframes may strain resources, according to a PwC privacy compliance survey
- Consent Management: Implementing systems to obtain and track user consent can be technically challenging, as noted in GDPR consent management case studies
- Cross-Border Data Transfers: Ensuring compliance when transferring data outside of Kansas may create operational complexities, similar to challenges faced with GDPR data transfer requirements
Implementation Best Practices
To effectively implement the requirements of the Kansas Privacy Protection Act:
- Conduct a Data Inventory: Use data discovery tools to map personal data flows, following guidance from the NIST Privacy Framework
- Implement a Privacy Management Platform: Consider privacy compliance software to manage consumer requests and consent, such as those reviewed by G2
- Develop a Privacy Training Program: Educate employees on privacy requirements using resources from organizations like the IAPP
- Perform Regular Assessments: Conduct ongoing privacy impact assessments using templates from NIST
- Create Data Retention Policies: Establish clear data retention and deletion procedures aligned with FTC data minimization principles
Recent Updates
As of March 2025, the Kansas Privacy Protection Act (SB 365) remains a proposed bill:
- The bill was introduced in the Kansas Senate on January 22, 2025
- Public hearings were held by the Senate Committee on Federal and State Affairs in February 2025
- The bill is currently under review, with no set implementation date if passed
Related Regulations
The Kansas Privacy Protection Act would interact with several existing regulations:
- CCPA/CPRA: California's privacy laws have similar consumer rights provisions, detailed in the California Attorney General's CCPA page
- GDPR: The EU's data protection regulation has influenced many state privacy laws, as explained on the European Commission's GDPR portal
- GLBA: Financial institutions must also comply with federal privacy rules under the Gramm-Leach-Bliley Act
- HIPAA: Healthcare entities have additional privacy obligations under HIPAA regulations
Industry Impact
The proposed Kansas Privacy Protection Act would significantly impact various industries:
- Technology Companies: Tech firms may need to revamp data practices and user interfaces, as discussed in TechCrunch's analysis of state privacy laws
- Retail and E-commerce: Businesses must update privacy policies and implement new consumer rights processes, according to NRF's retail privacy compliance guide
- Financial Services: Banks and insurers will face overlapping requirements with existing regulations, as noted in FINRA's cybersecurity guidance
- Healthcare: Medical providers must reconcile the Act with HIPAA requirements, as explained in AMA's privacy law resource center
Sources
- Kansas Legislature - SB 365 Text
- IAPP Privacy Program Management Guide
- PwC Privacy Compliance Survey
- GDPR Consent Management Case Studies
- EDPB Recommendations on Data Transfers
- NIST Privacy Framework
- G2 Privacy Management Software Reviews
- IAPP Training Resources
- FTC Start with Security Guide
- California Attorney General CCPA Page
- European Commission GDPR Portal
- FTC Gramm-Leach-Bliley Act Guide
- HHS HIPAA Portal
- TechCrunch State Privacy Law Analysis
- NRF Retail Privacy Compliance Guide
- FINRA Cybersecurity Guidance
- AMA Privacy Law Resource Center
Recent developments
- — Privacy law practitioners’ April 6, 2026 roundup of proposed state privacy laws notes that Kansas still does **not** have a general consumer privacy statute in effect and does not list a Kansas Privacy Protection Act among active bills, indicating no recent movement or enactment of SB 365 in the 2026 sessions.[5][2] (source)
- — OneTrust DataGuidance’s Kansas jurisdiction profile, updated in early 2026, confirms Kansas **does not currently have a general privacy law** and only has sectoral/privacy‑related statutes (No‑Call Act, Consumer Protection Act, data breach rules), with no reference to a Kansas Privacy Protection Act (SB 365), suggesting the proposal has not advanced or been adopted.[2] (source)
- — FastDemocracy’s Kansas bill tracker for SB 372 shows the legislature’s privacy‑related focus is on the **App Store Accountability Act** for minors’ online safety and age verification, not on a comprehensive Kansas Privacy Protection Act; the tracker does not list an SB 365 titled Kansas Privacy Protection Act in the 2025‑2026 session.[7] (source)
- — Kansas Reflector reports the Senate passed a bill compelling state officials to share SNAP benefit recipients’ personal data with the federal government, highlighting ongoing debates around government use of personal data, but the article does **not** mention or link this measure to any Kansas Privacy Protection Act (SB 365), implying separate, narrower data‑sharing legislation rather than a broad privacy act.[1] (source)
- — FastDemocracy’s entry for 2025‑2026 SB 360 (Kansas Consumer Prescription Protection and Accountability Act) shows legislative attention on regulating pharmacy benefit managers, with no appearance of a Kansas Privacy Protection Act bill number or title, indicating SB 365 is not among the top tracked privacy or data‑related bills this session.[8] (source)
- — The Kansas entry on DataGuidance reiterates that Kansas privacy activity remains limited to breach notification and sectoral rules and references no general privacy proposal such as a Kansas Privacy Protection Act (SB 365), suggesting that industry and compliance commentary currently treats Kansas as a **non‑comprehensive‑privacy** state.[2] (source)
- — In broader industry analysis of state privacy developments, Kansas is absent from lists of major pending comprehensive privacy bills, leading commentators to focus on other states (e.g., Maine, Kentucky, New York) for strategic planning; this omission indicates minimal perceived impact or reaction to any Kansas Privacy Protection Act proposal.[5] (source)
- — Compliance guidance for Kansas businesses continues to emphasize existing telemarketing, consumer protection, and breach‑notification obligations without advising preparation for a comprehensive privacy framework, which suggests that any Kansas Privacy Protection Act (SB 365) is not sufficiently advanced to affect current industry compliance programs.[2] (source)
- — Historical Kansas bill tracking for SB 360 (2023‑2024) shows the legislature’s pattern of naming and advancing bills, but there is no historical record of an SB 365 Kansas Privacy Protection Act being passed, reinforcing that such a bill remains at most a proposal without legislative traction or enacted policy changes.[6] (source)
- — Industry‑focused overviews of Kansas law describe the state as lacking a general privacy act and do not mention an SB 365 Kansas Privacy Protection Act, leading organizations to conclude that Kansas is a **watch‑and‑wait** jurisdiction for privacy rather than one requiring immediate operational changes.[2] (source)
Related regulations
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
- Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
- New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
- Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01
Put it into practice
- Generate the policy: Privacy policy generator (generatepolicy.com)
- Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
- Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates