Privacy Map

Alabama. Comprehensive data protection. Act

Alabama PDPAAlabama Personal Data Protection Act (HB 351, 2026)

Enacted – not yet in force

§1Summary

Synopsis

Comprehensive law with low volume thresholds but a headcount-based small business exemption, plus opt-in consent for targeted advertising or sale involving 13–15 year olds.

Key themes
  • consumer rights (access, deletion, correction, portability)
  • opt-out of sale, targeted advertising and profiling
  • sensitive data consent
  • data protection assessments
  • processor contracts
  • minors 13–15 opt-in
Unique features

Exempts businesses with under 500 employees unless they sell data; 45-day permanent cure; higher penalty ceiling than most peers.

SaaS relevance

Applies to processing data of more than 25,000 Alabama consumers or 25%+ revenue from sales, unless the SaaS has fewer than 500 employees and does not sell data.

§2Obligations

Extraterritorial
Yes
Breach notification
See Ala. Code § 8-38-1 et seq. (separate statute)
DPO
No
Cross-border transfers
None
Maximum penalty
Up to $15,000 per violation

§3Dates

Key dates
  • Adopted
  • In force

§4Text and authority

Text
Authority
Alabama Attorney General

§5Where it applies

Domestic law of
Alabama

§6Sources and verification

Verification

High confidence.

text_url is the legislature portal; direct bill link not confirmed.