DPO SchoolDPO School

Alabama Personal Data Protection Act

Alabama privacy law: enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General may enforce the act after first issuing a notice of violation. If the controller does not correct the violation within 45 days, the Attorney General may sue for an injunction, and the court may impose a civil penalty of up to $15,000 per violation. No action may be brought if the controller corrects the violation in time and gives a written statement that it will not recur. The cure period has no end date.

Key points

  1. The Attorney General may enforce the act.

    Section: Act 2026-552, § 11(a) (Ala. Code § 8-44-11)

  2. A notice of violation must precede any action.

    Section: Act 2026-552, § 11(b)(1) (Ala. Code § 8-44-11)

  3. 45-day cure period, with no sunset; cure plus a written statement bars any action.

    Section: Act 2026-552, § 11(b)(2), (3) (Ala. Code § 8-44-11)

  4. Civil penalty up to $15,000 per violation, in an action for an injunction, after failure to cure.

    Section: Act 2026-552, § 11(b)(2) (Ala. Code § 8-44-11)

  5. No private right of action is created.

    Section: Act 2026-552, § 11 (Ala. Code § 8-44-11)

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Alabama statute

Reference material, not legal advice.