Privacy Map

Alabama. Breach notification. Act

AL breach lawAlabama data breach notification law (Ala. Code § 8-38-1 et seq. (Data Breach Notification Act of 2018))

In force
Partly verifiedMedium confidence. Penalty figures from recollection of § 8-38-9, not confirmed on the summary page fetched.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Alabama residents to notify affected individuals after a security breach. Core timing rule: Individuals within 45 days of determining a breach likely to cause substantial harm. Covered data: name plus SSN/tax ID, government ID numbers, financial account with access codes, medical and health insurance information, and online account credentials.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Fixed 45-day outer limit for individuals and the AG; notice required only where substantial harm is reasonably likely; also imposes reasonable security measures on covered entities.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Alabama requires a third-party agent to tell the covered entity as soon as practicable and no later than 10 days after it determines or suspects a breach. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals within 45 days of determining a breach likely to cause substantial harm; AG within 45 days if >1,000 residents; CRAs if >1,000
DPO
No
Cross-border transfers
None
Maximum penalty
Civil penalties under the Deceptive Trade Practices Act; failure to notify up to $5,000 per day for each consecutive day, capped at $500,000 per breach

§3Dates

Key dates
  • Adopted
  • In force
  • Enacted by SB 318 (2018); no later amendment identified

§4Text and authority

Text
Authority
Alabama Attorney General

§5Where it applies

Domestic law of
Alabama

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Penalty figures from recollection of § 8-38-9, not confirmed on the summary page fetched.