Alabama Personal Data Protection Act

Does Alabama have a comprehensive privacy law? Yes. Governor Kay Ivey signed the Alabama Personal Data Protection Act (HB 351) in April 2026, and it takes effect on May 1, 2027.

• Status: Enacted (Not Yet in Effect)
• Law: Alabama Personal Data Protection Act (HB 351, 2026; Act 2026-552)
• Signed: April 17, 2026 (date the Legislature’s record lists the act as enacted) · Effective: May 1, 2027
• Applies to: Persons that conduct business in Alabama or produce products or services targeted to Alabama residents and that control or process the personal data of more than 25,000 consumers (excluding data processed solely to complete a payment transaction), or derive more than 25% of gross revenue from the sale of personal data
• Cure period: Yes; 45 days after the Attorney General’s notice of violation; the act sets no end date
• Enforcement: Alabama Attorney General; injunction and a civil penalty of up to $15,000 per violation if the violation is not cured
• Last verified: November 4, 2026 · Official source: HB 351 enrolled act (Alabama Legislature)

​​​​Alabama Personal Data Protection Act (HB 351) 

Alabama has enacted its first comprehensive consumer privacy law. In April 2026, Governor Kay Ivey signed House Bill 351, the Alabama Personal Data Protection Act (Act 2026-552), into law after it passed the Alabama Legislature unanimously on April 7, 2026. The law will take effect on May 1, 2027.

Consumer Rights

Consumers have the right to access personal data, correct inaccuracies, delete personal data, obtain a portable copy of their data, and opt out of targeted advertising, the sale of personal data, and certain profiling activities.

Obligations for Businesses

Controllers and processors must follow requirements around data minimization, purpose limitation, security safeguards, privacy notices, consumer request handling, and contracts between controllers and processors. Consent is required for processing sensitive data.

Scope

The law applies to businesses that conduct business in Alabama or produce products or services targeted to Alabama residents and either control or process the personal data of more than 25,000 consumers, excluding payment transaction data processed solely to complete a payment transaction, or derive more than 25% of gross revenue from the sale of personal data.

Enforcement

The Alabama Attorney General enforces the law; the act does not provide for private lawsuits. Before bringing an action, the Attorney General must send the controller a notice of violation. If the controller does not cure the violation within 45 days, a court may assess a civil penalty of up to $15,000 per violation.

Alabama Personal Data Protection Act (HB 283) of 2025

Alabama is making strides in the data privacy space with the house passing HB 283, the Alabama Personal Data Protection Act. As of April 29, 2025, the bill is still making its way through the state senate.

What’s in the Bill?

Here’s a breakdown of what HB 283 proposes:

• Consumer Rights: The bill grants consumers key rights over their personal data, including:
  
  • Access to their personal data and information about its processing.
    
  • The ability to correct inaccurate data.
    
  • The right to delete personal data.
    
  • Data portability to move their data across platforms.
    
  • The ability to opt out of personal data processing for things like targeted advertising.
    
• Obligations for Businesses: Businesses (referred to as “controllers”) will have to:
  
  • Implement secure methods for consumers to exercise their rights.
    
  • Provide privacy notices that clearly outline how consumer data is used and shared.
    
  • Ensure data security to protect consumers’ personal information.
    
• Enforcement: The Alabama Attorney General will have the authority to enforce the provisions of the law, including penalties for non-compliance.
  
• Exemptions: Certain exemptions apply, including those related to de-identified data and situations where data is required for legal processes.
  

What’s Next?

HB 283 did not become law: it was still pending in the Alabama Senate’s Fiscal Responsibility and Economic Development Committee when the 2025 session ended. In 2026, the Legislature passed a new bill, HB 351, described above.

As of April 2025, Alabama had not yet enacted a comprehensive Alabama consumer privacy act or an Alabama Online Privacy Act.

Alabama also enacted a narrower data privacy law, SB59 (Act 2023-128), also referred to as The Personal Privacy Protection Act. The bill aims to protect the privacy of members, supporters, volunteers, or donors of a nonprofit organization.

It is important to note that under existing law, a public agency is not prohibited from disclosing certain personal information that identifies a person as a member, supporter, volunteer, or donor of a 501(c) nonprofit organization.

The bill would prohibit a public agency from disclosing personal information or requiring its disclosure, except as required by law. In addition, the bill would provide for civil and criminal penalties for violations.

Interestingly, Alabama’s constitution prohibits a general law whose purpose or effect would be to require a new or increased expenditure of local funds from becoming effective with regard to a local governmental entity without enactment by a ⅔ vote unless

• it comes within one of a number of specified exceptions
• it is approved by the affected entity
• the Legislature appropriates funds, or provides a local source of revenue, to the entity for the purpose.

In reality, this bill would require a new or increased expenditure of local funds within the meaning of the amendment. However, the bill does not require approval of a local governmental entity or enactment by a 2/3 vote to become effective because the bill defines a new crime or

amends the definition of an existing crime, as explained in the state constitution.

SB 59 relates to the disclosure of certain personal information and is titled The Personal

Privacy Protection Act. Let’s run through the contents of the bill.

Definition of Terms

Nonprofit Organization

An entity that is exempt from federal income tax under Section 501(c) of the IRS or is a nonprofit business entity recognized under state law.

Personal Information

Any list, record, register, registry, roll, roster, or other compilation of data of any kind that directly or indirectly identifies a person as a member, supporter, volunteer, or donor of financial or nonfinancial support to any nonprofit organization.

Public Agency

Any department, agency, office, commission, board, division, or other entity of this state, or

of any political subdivision of this state.

Requirements for Public Agencies

A public agency shall not do any of the following:

• Require any person or nonprofit organization to provide the public agency with personal information or otherwise compel the release of personal information.
• Release, publicize, or otherwise publicly disclose personal information in its possession.
• Request or require a current or prospective contractor or grantee of the public agency to provide a list of nonprofit organizations to which the current or prospective contractor or grantee has provided financial or nonfinancial support.

Exemptions

• Any report or disclosure required by The Fair Campaign Practices Act, Chapter 5 of Title 17, Code of Alabama 1975, or any successor provisions thereto.
• Any lawful warrant for personal information issued by a court of competent jurisdiction.
• Any lawful request for discovery of personal information in litigation if all written conditions are met.
• Admission of personal information as relevant evidence before a court of competent jurisdiction; however, no court shall publicly reveal personal information absent a specific finding of good cause.
• A release of personal information by any public agency if the information had previously been voluntarily released to the public either by the person to which it pertains or by a nonprofit organization to which the person is a donor.
• The keeping of filings, certificates, and other public records that disclose the identity of any director, officer, registered agent, or incorporator of a nonprofit organization in any report or disclosure required by law to be filed with the Secretary of State, except that information that directly identifies a person as a donor of financial support to a nonprofit organization, shall not be collected or disclosed.
• Disclosure of personal information derived from a donation to a nonprofit organization affiliated with a public agency as required by law, if the person has not previously requested anonymity from the nonprofit organization.

Conclusion

The act, enacted in 2023 as Act 2023-128, provided that it would become effective on the first day of the third month following its passage and approval by the Governor, or its otherwise becoming law.