--- title: "Alabama privacy law: controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/alabama/controller-duties" source: "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Alabama Personal Data Protection Act # Alabama privacy law: controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and not process data for undisclosed incompatible purposes. The privacy notice must list categories of data, purposes, data shared and categories of third parties, an active email or contact mechanism, and how to exercise rights and opt out. The act does not require data protection assessments. It does not expressly require controllers to honour opt-out preference signals, although it says how to resolve a conflict when such a signal is received. ## Key points 1. Collection limited to what is adequate, relevant and reasonably necessary for the purposes of processing. Section: [Act 2026-552, § 7(a)(1) (Ala. Code § 8-44-7)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 2. Reasonable administrative, technical and physical security practices. Section: [Act 2026-552, § 7(a)(2) (Ala. Code § 8-44-7)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 3. Privacy notice: categories of data, purposes, categories shared and of third parties, an active email or contact mechanism, and how to exercise rights including the opt-out link. Section: [Act 2026-552, § 7(d) (Ala. Code § 8-44-7)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 4. Sale and targeted advertising must be disclosed clearly, with the opt-out method. Section: [Act 2026-552, § 7(c) (Ala. Code § 8-44-7)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 5. If an opt-out preference signal conflicts with a consumer's own settings or loyalty program, the signal prevails, but the controller may ask the consumer to confirm. Section: [Act 2026-552, § 6(c)(1) (Ala. Code § 8-44-6)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 6. No data protection assessment duty appears in the act. Section: [Act 2026-552, §§ 7 to 10 (Ala. Code §§ 8-44-7 to 8-44-10)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) 7. No new account may be required to exercise rights; contract terms waiving rights are void. Section: [Act 2026-552, § 7(e)(2), (f) (Ala. Code § 8-44-7)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) ## Sources - [HB 351 (2026 RS), enrolled act text](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Alabama statute](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) Reference material, not legal advice. ## Other topics for Alabama - [Applicability](https://dposchool.com/state-privacy-laws/state/alabama/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/alabama/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/alabama/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/alabama/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/alabama/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Alabama](https://dposchool.com/state-privacy-laws/state/alabama) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/alabama/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/alabama/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents