Privacy Law Library

Alabama Data Breach Notification Act of 2018

ADBNA

Breach notification · Data security

Requires covered entities to protect sensitive personally identifying information with reasonable security measures, investigate suspected breaches, and notify affected Alabama residents within 45 days when a breach is reasonably likely to cause substantial harm. Larger breaches also require notice to the Attorney General and the national consumer reporting agencies, and records must be disposed of securely.

Where
Alabama
Citation
Ala. Code §§ 8-38-1 to 8-38-12 (Act 2018-396, SB318)
Status
In force
In force since
2018-06-01
Enforced by
Alabama Attorney General (exclusive)
People can sue
No
Penalties
Violations of the notice provisions are unlawful trade practices under the Alabama Deceptive Trade Practices Act (not criminal). Knowing violations are subject to ADTPA civil penalties capped at $500,000 per breach; separately, up to $5,000 per day for each consecutive day a covered entity fails to take reasonable action to notify. The AG may also recover actual damages for named individuals. Government entities are exempt from civil penalties.
Applies to
  • Covered entities: any person, business, nonprofit, or government entity that acquires or uses sensitive personally identifying information of Alabama residents
  • Third-party agents that maintain, store, process, or access such information for a covered entity
  • Entities complying with federal breach rules, or state rules at least as thorough, are exempt if they maintain procedures, notify individuals, and copy the AG on breaches over 1,000 people

Practices it requires

  • If notice is determined not to be required, document the determination in writing and keep records for at least five years.Ala. Code § 8-38-5(f)

Security duties

  • Dispose of records containing sensitive personally identifying information by shredding, erasing, or otherwise making the information unreadable when no longer needed.Ala. Code § 8-38-10
  • Implement and maintain reasonable security measures, weighing factors such as a designated security coordinator, risk identification, safeguards, vendor contracts, and keeping management informed.Ala. Code § 8-38-3

Breach duties

  • Substitute notice (30-day website posting plus print and broadcast media) is allowed if direct notice would cost over $500,000, contact data is lacking, or over 100,000 people are affected.Ala. Code § 8-38-5(e)
  • Promptly conduct a good-faith investigation of any possible breach, assessing scope, data and individuals affected, likelihood of substantial harm, and restoring security.Ala. Code § 8-38-4
  • Notify affected individuals in writing or by email as expeditiously as possible and within 45 days after determining a breach is reasonably likely to cause substantial harm, with specified content.Ala. Code § 8-38-5(a)-(d) · Only if: Breach reasonably likely to cause substantial harm
  • Third-party agents must notify the covered entity of a breach within 10 days of determining or having reason to believe it occurred.Ala. Code § 8-38-8
  • Notify all nationwide consumer reporting agencies without unreasonable delay when more than 1,000 individuals are notified at a single time.Ala. Code § 8-38-7 · Only if: More than 1,000 individuals notified
  • Notify the Attorney General within 45 days when more than 1,000 Alabama residents must be notified, including a synopsis, count, services offered, and a contact.Ala. Code § 8-38-6 · Only if: More than 1,000 individuals notified

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Effective date of June 1, 2018 is computed from the enrolled act's effective-date clause and the March 28, 2018 approval date; the Code history line does not state it.

Research reference, not legal advice.