Alabama Personal Data Protection Act (HB 351)

Comprehensive consumer privacy law signed 17 April 2026, the 21st state framework: consumer rights of access, deletion, correction and opt-out of sale and targeted advertising, with Attorney General enforcement and a cure period.

JurisdictionAlabama
CategoryPrivacy & Data Protection
StatusUpcoming
Effective date
Latest development

Analysis

The Alabama Personal Data Protection Act (APDPA), enacted through HB 351 / Act 2026-552, was signed on April 17, 2026, and takes effect on May 1, 2027. The official enrolled bill is the controlling source for the Act’s requirements; the available legislative record identifies consumer rights, controller and processor duties, deidentified-data rules, and Attorney General enforcement provisions.[Alabama enrolled HB 351] [Alabama legislative acts page]

The analysis below is based on the enacted bill and publicly available legislative and legal analyses. Organizations should verify the final codified text and any Attorney General guidance before relying on operational interpretations.

Key Requirements

Applicability and covered organizations

  • The APDPA applies to persons that conduct business in Alabama or target products or services to Alabama residents and satisfy either of the statutory thresholds: processing the personal data of more than 25,000 Alabama consumers, excluding data processed solely to complete a payment transaction, or deriving more than 25% of gross revenue from the sale of personal data.[Enrolled HB 351] [Mayer Brown analysis]
  • The threshold structure is narrower in data volume than some state privacy laws but potentially broad for businesses whose revenue depends substantially on personal-data sales.[Mayer Brown analysis] [IAPP analysis]

Consumer rights

Covered controllers must provide mechanisms enabling consumers to exercise rights involving their personal data, including:

  • Confirmation and access: the right to confirm whether a controller is processing the consumer’s personal data and obtain access to that data.[Enrolled HB 351]
  • Correction: the right to correct inaccuracies in personal data maintained by the controller.[Enrolled HB 351]
  • Deletion: the right to direct a controller to delete personal data concerning the consumer, subject to statutory exceptions.[Enrolled HB 351]
  • Data portability: the right to obtain a copy of personal data in a portable format, subject to limitations applicable to trade secrets and other protected information.[Enrolled HB 351] [Mayer Brown analysis]
  • Opt-out rights: consumers may opt out of the processing of personal data for sale, targeted advertising, and certain profiling or automated decision-making activities.[Enrolled HB 351] [IAPP analysis]
  • Authorized agents: the legislation authorizes consumers to designate an authorized agent to exercise rights on their behalf, requiring organizations to account for agent-based requests in their request-verification procedures.[Introduced HB 351 summary]

Request handling and appeals

  • Practical compliance programs should therefore support request intake, identity verification, response tracking, exception analysis, appeals, and auditable records. These operational controls follow directly from the Act’s rights and appeals structure, although the precise procedural deadlines should be confirmed against the final enacted text and any future guidance.[Enrolled HB 351]

Controller obligations

  • Controllers must regulate their processing of personal data consistently with the Act, including honoring consumer rights and applying the statutory restrictions on data processing.[Enrolled HB 351]
  • Organizations should maintain a documented inventory of personal data, processing purposes, disclosures, sales, targeted-advertising uses, retention practices, and applicable exemptions to demonstrate how their processing aligns with the Act.[Enrolled HB 351] [NIST Privacy Framework]

Processor obligations

  • Data processors have separate statutory obligations and should process personal data only under appropriate controller instructions and contractual arrangements.[Enrolled HB 351]
  • Contracts with processors should address documented processing instructions, confidentiality, security, assistance with consumer rights, deletion or return of data, subprocessors, incident cooperation, and audit or compliance evidence. These contract elements are also consistent with established privacy frameworks such as the GDPR’s controller-processor model.[EUR-Lex GDPR Article 28] [NIST Privacy Framework]

Deidentified data

  • The Act regulates the processing of deidentified data and requires organizations relying on deidentification to apply documented controls rather than treating deidentification as an unrestricted exemption.[Enrolled HB 351]
  • Organizations should document the methods used to prevent reidentification, restrict attempts to reidentify individuals, and separate deidentified datasets from directly identifying information. NIST provides technical guidance relevant to de-identification risk management.[NIST De-Identifying Government Datasets] [NIST Privacy Framework]

Enforcement and penalties

  • Before filing an enforcement action, the Attorney General must issue a notice of violation and provide the controller with a 45-day cure period to correct the alleged violation and notify the Attorney General of the correction.[Fisher Phillips analysis]

Compliance Challenges

Determining whether the law applies

  • The principal scoping challenge is calculating whether the organization processes data of more than 25,000 Alabama consumers and determining whether excluded payment-transaction data has been counted correctly.[Mayer Brown analysis] [Enrolled HB 351]
  • Businesses may also need to calculate whether more than 25% of gross revenue derives from personal-data sales, which requires coordination among legal, finance, advertising, data-governance, and sales functions.[Mayer Brown analysis]

Mapping data across complex environments

  • Organizations commonly struggle to identify where personal data is collected, stored, shared, sold, deleted, and replicated across SaaS platforms, analytics tools, advertising systems, backups, and processors. NIST identifies data inventories, processing visibility, and governance as central privacy-program activities.[NIST Privacy Framework] [NIST Cybersecurity Framework 2.0]
  • The challenge is especially significant for organizations using multiple vendors, because a consumer deletion or access request may require coordinated action across internal systems and service providers.[EUR-Lex GDPR Article 28] [Enrolled HB 351]

Verifying consumer requests without collecting excessive information

Handling deletion and retention conflicts

  • Deletion workflows must distinguish data that can be removed from data that must be retained for legal, security, accounting, fraud-prevention, or dispute-related purposes. The Act’s statutory exceptions and other applicable legal obligations must be incorporated into the deletion decision process.[Enrolled HB 351] [NIST Privacy Framework]

Managing targeted advertising and data sales

  • Organizations must identify which disclosures constitute a regulated sale and which advertising or profiling activities fall within the Act’s opt-out rights. This is difficult where advertising technology involves multiple intermediaries, identifiers, pixels, SDKs, and data brokers.[Enrolled HB 351] [IAPP analysis]

Preparing for enforcement despite the cure period

  • A cure period reduces immediate enforcement exposure but does not eliminate the need for evidence of compliance. Organizations must be able to investigate allegations, remediate quickly, and demonstrate correction to the Attorney General.[Fisher Phillips analysis] [Alabama Attorney General]

Real-world privacy-program difficulties

  • Industry surveys consistently identify data discovery, fragmented systems, vendor risk, request fulfillment, and changing state-law requirements as major privacy-program challenges. The IAPP’s annual governance and privacy-management research provides sector-level evidence of these operational pressures.[IAPP research] [Cisco Data Privacy Benchmark Study]

Implementation Best Practices

Establish governance and accountability

Build a data inventory and processing register

  • Create a record for each processing activity identifying the data categories, consumer populations, collection source, purpose, systems, recipients, processors, retention period, security controls, and applicable exemption.[NIST Privacy Framework] [EUR-Lex GDPR Article 30]

Implement a rights-request workflow

  • Test access, correction, deletion, portability, sale opt-out, targeted-advertising opt-out, and profiling opt-out scenarios before the effective date.[Enrolled HB 351]

Review notices and consent mechanisms

Contract with processors and vendors

  • Update data-processing agreements to define the parties’ roles, processing instructions, confidentiality, security, subprocessors, rights-request assistance, deletion or return, incident cooperation, and audit evidence.[EUR-Lex GDPR Article 28] [NIST Privacy Framework]
  • Include contractual obligations for vendors supporting advertising, analytics, customer service, identity verification, cloud hosting, and data brokerage, because these vendors may receive or otherwise process personal data relevant to consumer requests.[Enrolled HB 351] [FTC Protecting Consumer Privacy and Security]

Strengthen security and incident readiness

  • Apply access control, least privilege, encryption, logging, vulnerability management, secure development, backup protection, and incident-response testing to systems containing personal data.[NIST Cybersecurity Framework 2.0] [NIST SP 800-53]

Use a staged implementation plan

  • Before the effective date: determine applicability, map data, review advertising and sale practices, update contracts, design rights workflows, and revise notices.[Enrolled HB 351] [Mayer Brown analysis]
  • After launch: monitor legislative amendments, Attorney General guidance, enforcement activity,

Recent developments

  • — Recent practitioner coverage continues to focus on compliance readiness rather than any change to the statute. The ongoing industry impact is that companies are using the lead time before 2027-05-01 to align privacy notices, consumer request workflows, and vendor contracts. (source)
  • — A later update to the legislative tracker confirms the law remains on track for the 2027-05-01 effective date. No post-enactment amendment or delay is indicated in the available source. (source)
  • — DataGuidance describes the Alabama Personal Data Protection Act as Alabama’s first comprehensive consumer privacy framework and says it is effective 2027-05-01. The jurisdiction page also notes the Attorney General’s enforcement role. (source)
  • — This legislative tracker records HB 351 as enacted and signed by Governor Ivey on 2026-04-17, with a 2027-05-01 effective date. It also summarizes consumer rights, sensitive data treatment, and enforcement by the Attorney General. (source)
  • — This industry commentary says businesses outside Alabama may still be covered if they target Alabama residents and meet the law’s thresholds. It also highlights implementation details such as 45-day response timelines and the law’s definition of sale. (source)
  • — Hunton summarized the new Alabama privacy law after enactment and noted the effective date of 2027-05-01. The post explains the law’s applicability thresholds and confirms it as Alabama’s comprehensive consumer privacy statute. (source)
  • — Governor Kay Ivey signed HB 351 into law, enacting the Alabama Personal Data Protection Act. The law establishes consumer privacy rights and obligations for businesses and is set to take effect on 2027-05-01. (source)
  • — Industry counsel framed the law as creating new compliance obligations for businesses handling Alabama residents’ data. The post emphasizes operational impacts such as consumer rights handling, data processing controls, and preparation ahead of the 2027-05-01 effective date. (source)
  • — Alabama became the 21st state to enact a broad consumer data privacy law, and one of the more business-friendly versions passed in 2026. The article highlights scope, thresholds, and the 2027-05-01 effective date. (source)
  • — Consumer Reports urged Governor Ivey to veto HB 351, arguing the bill was too weak to meaningfully protect consumers. The article also reports criticism from privacy advocates about loopholes, carveouts, and enforcement limitations. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates