--- title: "Alabama privacy law: applicability" canonical: "https://dposchool.com/state-privacy-laws/state/alabama/applicability" source: "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Alabama Personal Data Protection Act # Alabama privacy law: applicability Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) The act applies to persons doing business in Alabama or targeting its residents that either control or process personal data of more than 25,000 consumers (excluding payment-only data) or derive more than 25% of gross revenue from selling personal data, whatever the number of consumers. It has broad entity exemptions, notably for businesses with fewer than 500 employees and nonprofits with fewer than 100 employees, in each case only if they do not sell personal data. GLBA financial institutions and their affiliates, HIPAA covered entities and business associates, higher education and several regulated sectors are also excluded, and many data types are exempt. ## Key points 1. Threshold: personal data of more than 25,000 consumers, not counting data used only to complete a payment. Section: [Act 2026-552, § 3(1) (Ala. Code § 8-44-3)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 2. Alternative threshold: more than 25% of gross revenue from selling personal data, regardless of consumer numbers. Section: [Act 2026-552, § 3(2) (Ala. Code § 8-44-3)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 3. Businesses with fewer than 500 employees are exempt unless they sell personal data. Section: [Act 2026-552, § 4(a)(7) (Ala. Code § 8-44-4)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 4. Nonprofits with fewer than 100 employees are exempt unless they sell personal data; larger nonprofits are covered. Section: [Act 2026-552, § 4(a)(8) (Ala. Code § 8-44-4)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 5. Entity-level exemptions for GLBA financial institutions and affiliates, HIPAA covered entities and business associates, two- and four-year higher education institutions, and political subdivisions. Section: [Act 2026-552, § 4(a)(1) to (6) (Ala. Code § 8-44-4)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 6. Further exemptions for certain regulated persons, political committees and the businesses selling data mainly to them, and electric providers subject to NERC standards. Section: [Act 2026-552, § 4(a)(9) to (13) (Ala. Code § 8-44-4)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 7. Data exemptions include HIPAA, research, FCRA, DPPA, FERPA, Farm Credit Act and airline data, employment data, and data collected to comply with state law. Section: [Act 2026-552, § 4(b) (Ala. Code § 8-44-4)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 8. 'Sale' includes non-monetary exchanges only where the controller gets a material benefit and the third party's later use is unrestricted; analytics and marketing services solely for the controller are excluded. Section: [Act 2026-552, § 2(20) (Ala. Code § 8-44-2)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) ## Sources - [HB 351 (2026 RS), enrolled act text](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) [Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Alabama statute](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) Reference material, not legal advice. ## Other topics for Alabama - [Consumer rights](https://dposchool.com/state-privacy-laws/state/alabama/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/alabama/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/alabama/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/alabama/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/alabama/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Alabama](https://dposchool.com/state-privacy-laws/state/alabama) / Applicability Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/alabama/consumer-rights) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents