Alabama Personal Data Protection Act
Alabama privacy law: controller duties
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and not process data for undisclosed incompatible purposes. The privacy notice must list categories of data, purposes, data shared and categories of third parties, an active email or contact mechanism, and how to exercise rights and opt out. The act does not require data protection assessments. It does not expressly require controllers to honour opt-out preference signals, although it says how to resolve a conflict when such a signal is received.
Key points
Collection limited to what is adequate, relevant and reasonably necessary for the purposes of processing.
Reasonable administrative, technical and physical security practices.
Privacy notice: categories of data, purposes, categories shared and of third parties, an active email or contact mechanism, and how to exercise rights including the opt-out link.
Sale and targeted advertising must be disclosed clearly, with the opt-out method.
If an opt-out preference signal conflicts with a consumer's own settings or loyalty program, the signal prevails, but the controller may ask the consumer to confirm.
No data protection assessment duty appears in the act.
Section: Act 2026-552, §§ 7 to 10 (Ala. Code §§ 8-44-7 to 8-44-10)
No new account may be required to exercise rights; contract terms waiving rights are void.
Sources
Compare controller duties across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 35: Data protection impact assessment (assessments)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Alabama statute
Reference material, not legal advice.