DPO SchoolDPO School

Alabama Personal Data Protection Act

Alabama privacy law: processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must follow controller instructions and help with consumer requests, security and breach notification. A binding contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and must require confidentiality, deletion or return at the end (unless law or the contract permits retention), compliance information, and flow-down obligations for subcontractors. The act does not require a contractual audit or assessment clause.

Key points

  1. Processors must follow instructions and assist with consumer requests, security and breach notification.

    Section: Act 2026-552, § 8(a) (Ala. Code § 8-44-8)

  2. A binding contract must set out instructions, nature and purpose, data types, duration and rights and obligations of both parties.

    Section: Act 2026-552, § 8(b)(2) (Ala. Code § 8-44-8)

  3. Contract must require confidentiality and deletion or return at the end, unless retention is required or permitted by law or the contract.

    Section: Act 2026-552, § 8(b)(3)(a), (b) (Ala. Code § 8-44-8)

  4. Contract must require compliance information on reasonable request and flow-down obligations for subcontractors.

    Section: Act 2026-552, § 8(b)(3)(c), (d) (Ala. Code § 8-44-8)

  5. A person not limited by, or not following, controller instructions is a controller.

    Section: Act 2026-552, § 8(d) (Ala. Code § 8-44-8)

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Alabama statute

Reference material, not legal advice.