DPO SchoolDPO School

Alabama Personal Data Protection Act

Alabama privacy law: applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The act applies to persons doing business in Alabama or targeting its residents that either control or process personal data of more than 25,000 consumers (excluding payment-only data) or derive more than 25% of gross revenue from selling personal data, whatever the number of consumers. It has broad entity exemptions, notably for businesses with fewer than 500 employees and nonprofits with fewer than 100 employees, in each case only if they do not sell personal data. GLBA financial institutions and their affiliates, HIPAA covered entities and business associates, higher education and several regulated sectors are also excluded, and many data types are exempt.

Key points

  1. Threshold: personal data of more than 25,000 consumers, not counting data used only to complete a payment.

    Section: Act 2026-552, § 3(1) (Ala. Code § 8-44-3)

  2. Alternative threshold: more than 25% of gross revenue from selling personal data, regardless of consumer numbers.

    Section: Act 2026-552, § 3(2) (Ala. Code § 8-44-3)

  3. Businesses with fewer than 500 employees are exempt unless they sell personal data.

    Section: Act 2026-552, § 4(a)(7) (Ala. Code § 8-44-4)

  4. Nonprofits with fewer than 100 employees are exempt unless they sell personal data; larger nonprofits are covered.

    Section: Act 2026-552, § 4(a)(8) (Ala. Code § 8-44-4)

  5. Entity-level exemptions for GLBA financial institutions and affiliates, HIPAA covered entities and business associates, two- and four-year higher education institutions, and political subdivisions.

    Section: Act 2026-552, § 4(a)(1) to (6) (Ala. Code § 8-44-4)

  6. Further exemptions for certain regulated persons, political committees and the businesses selling data mainly to them, and electric providers subject to NERC standards.

    Section: Act 2026-552, § 4(a)(9) to (13) (Ala. Code § 8-44-4)

  7. Data exemptions include HIPAA, research, FCRA, DPPA, FERPA, Farm Credit Act and airline data, employment data, and data collected to comply with state law.

    Section: Act 2026-552, § 4(b) (Ala. Code § 8-44-4)

  8. 'Sale' includes non-monetary exchanges only where the controller gets a material benefit and the third party's later use is unrestricted; analytics and marketing services solely for the controller are excluded.

    Section: Act 2026-552, § 2(20) (Ala. Code § 8-44-2)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Alabama statute

Reference material, not legal advice.