Kentucky Revised Statutes Title XXXI. Debtor-Creditor Relations § 380.070.Debt adjuster to take reasonable measures to protect debtor’s personal information

(a) Ensure the security and confidentiality of a debtor's personal information;

(b) Protect against any anticipated threats or hazards to the security or integrity of a debtor's personal information; and

(c) Protect against unauthorized access to or use of a debtor's personal information.

(a) Design and implementation of a comprehensive information security program that:

(b) Design and implementation of information safeguards to control the risks identified by the risk assessment required by this subsection, as well as regular testing or other monitoring of the effectiveness of the safeguards of key controls, systems, and procedures;

(c) Requirements for regular training of employees who will or may have access to records containing personal information of debtors regarding compliance with the information security program required by this subsection;

(d) Oversight of service providers to whom personal information of a debtor will be disclosed, by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the personal information at issue, as well as requiring service providers, by contract, to implement and maintain those safeguards;

(e) Evaluation and adjustment of the information security program in light of the results of testing and monitoring, any material changes to the operation or business arrangements of the debt adjuster, or any other circumstances that the debt adjuster knows or has reason to know may have a material impact on compliance with the information security program; and

(f) A requirement that when records containing personal information of a debtor are disposed of the records shall be shredded, erased, or otherwise modified so the personal information is made unreadable or indecipherable through any means.