Processes personal data, in Alabama

Ala. Code secs. 8-38-3, 8-38-10 · Read the law's page

• Implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security. The measures required are those practicable for the entity, including consideration of: designating an employee or employees to coordinate the effort, identifying internal and external risks, adopting and assessing information safeguards, retaining service providers contractually required to maintain appropriate safeguards, evaluating and adjusting the measures for changed circumstances, and keeping management, including the board of directors where one exists, informed of the overall status of the measures. An assessment of the entity's security looks at its measures as a whole, emphasizing failures that are multiple or systemic, and weighs the entity's size, the amount and type of information and activities, and its cost of the measures relative to its resources.
• Take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.
• This binds any covered entity (a person, sole proprietorship, partnership, government entity, corporation, nonprofit, trust, estate, cooperative association, or other business entity that acquires or uses sensitive personally identifying information of an Alabama resident) and any third-party agent it contracts with to maintain, store, process, or access that information. An entity already subject to and complying with a federal or state data-breach-notification regime at least as thorough as this chapter is exempt from the entire chapter.
• There is no private right of action for a violation of either duty. Only the Attorney General may bring an action for civil penalties under the chapter, and the chapter's only stated civil-penalty amounts (up to $500,000 per breach, or $5,000 per day) are tied expressly to a violation of the chapter's separate notification provisions, not to this reasonable-security-measures or disposal duty; no distinct penalty figure is stated for either duty. The Attorney General may also sue for actual damages on behalf of named individuals (Section 8-38-9(b)(2)), and may sue a state, county or municipal official or employee to compel performance of the official's duties under the chapter, while government entities themselves are exempt from civil penalties (Section 8-38-9(b)(6)).

Alabama Hospital Discharge Data Act, Ala. Code secs. 22-21-413 to 22-21-415 (Act 2021-129) · Read the law's page

• If you are the Alabama Hospital Association or the Alabama Department of Public Health, do not make available to the public any hospital discharge data or other information that reasonably could be expected to reveal the identity of any patient (section 22-21-413(c)).
• If you are the Alabama Department of Public Health, treat reported hospital discharge data as confidential and do not make it available to the public until you have processed and verified that it satisfies the requirements for public disclosure under the Act and applicable federal law (section 22-21-413(c)).
• If you are the Alabama Department of Public Health, adopt rules on the processed and verified discharge data made available to the public and on the release of limited data sets, and make the rules compliant with HIPAA (section 22-21-413(d)).
• If you are the Alabama Department of Public Health, do not include in a report or study you prepare and release from discharge data any information obtained from the data in a form which could be used to identify any patient (section 22-21-414).
• If you are the Alabama Department of Public Health, publish a study or information based on discharge data only if it does not include information in a form which could be used to identify any patient or violate HIPAA (section 22-21-415).

Alabama Genetic Data Privacy Act, Ala. Code secs. 8-43-1 to 8-43-6 · Read the law's page

• As a genetic testing company, display to the consumer in plain language your policies and procedures for the collection, use, maintenance and disclosure of genetic data: a privacy policy overview, the full privacy policy notice, a notice that genetic data may be included in deidentified data shared with a third party for research, and a description of how to file a complaint.
• Obtain the consumer's initial express consent to use of the biological sample and resulting genetic data to provide the ordered product or service, to who may have access (including a contractor), and to retention for future testing for other products or services, and tell the consumer you may later seek consent to transfer the sample or disclose the data to a third party other than a contractor.
• Obtain the consumer's express consent every time you transfer the biological sample or disclose genetic data to a third party other than a contractor for a reason other than fulfilling an order, use them for a purpose other than the ordered product or service, or market to the consumer based on genetic data (customized content on your own site or app is not marketing).
• Obtain the consumer's informed consent, in compliance with the federal rules for the protection of human subjects at 45 C.F.R. Part 46, before you transfer a biological sample or disclose genetic data for independent research by a third party or for research you sponsor.
• Provide a process for the consumer to access genetic data, delete the account, request destruction of the biological sample and genetic data, and revoke any express or informed consent given.
• Destroy the biological sample and genetic data as soon as reasonably possible and no more than 30 days after a destruction request, and secure the return of a sample and data transferred or disclosed on a consent the consumer revokes as soon as reasonably possible and no more than 60 days after the revocation.
• Do not disclose a consumer's genetic data to a person issuing health, life, disability or long-term care insurance, or to an employer or prospective employer of the consumer, without the consumer's express written consent.
• When law enforcement requests data under valid legal process, do not disclose the existence of the process or the fact of your compliance to the person it concerns (you may still publish a transparency report of the number and types of requests).
• Bind each contractor by contract not to use, retain or disclose a biological sample, extracted genetic material, genetic data or identifying information for any purpose other than the contracted service, and hold the contractor to the same confidentiality obligation as your own.

Ala. Code sec. 8-38-1 et seq. (Act 2018-396) · Read the law's page

• Notify each affected Alabama resident within 45 days after receiving notice of a breach from a third-party agent or after determining that a breach of security has acquired sensitive personally identifying information and is reasonably likely to cause substantial harm.
• Give the Alabama Attorney General written notice within 45 days when more than 1,000 individuals must be notified of a breach.
• As a third-party agent that has experienced a breach of security in a system it maintains, notify the covered entity as expeditiously as possible and without unreasonable delay, and no later than 10 days after determining the breach occurred or having reason to believe it occurred.
• Notify the nationwide consumer reporting agencies without unreasonable delay when more than 1,000 individuals must be notified at a single time.

Ala. HB 351, 2026 Regular Session, Sec. 11 · Read the law's page

• Expect the Alabama Attorney General to enforce APDPA violations under Section 11. The Act creates no private right of action.
• Cure a noticed violation within 45 days and provide a written statement confirming the cure to avoid a civil penalty of not more than $15,000 per violation; the Attorney General must give this 45-day cure notice before bringing any enforcement action.

Ala. HB 351, 2026 Regular Session, Sec. 8(b)(3)c, Sec. 10(g) · Read the law's page

• Include in every contract with a processor a requirement that the processor make available to you, on your reasonable request, all information in its possession necessary to demonstrate its compliance with the obligations of the Act.
• If you process personal data under an exemption in section 10 of the Act, be able to demonstrate that the processing qualifies for the exemption and complies with the requirements of that section.

Ala. HB 351, 2026 Regular Session, Sec. 9, Sec. 2(10), Sec. 2(18) · Read the law's page

• To treat data as deidentified under the Act, take reasonable measures to ensure that it cannot be associated with an individual and publicly commit to process it in a deidentified fashion only and not to attempt to reidentify it (Section 2(10)).
• If you are a controller in possession of deidentified data, take measures to ensure that the data cannot reasonably be associated with an individual (Section 9(a)(1)).
• Do not reidentify deidentified data when maintaining and using it (Section 9(a)(2)).
• Contractually obligate every recipient of deidentified data to comply with all provisions of Section 9 (Section 9(a)(3)).
• If you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments it is subject to, and take appropriate steps to address any breach of them (Section 9(e)).

Ala. HB 351, 2026 Regular Session, Secs. 1-4 · Read the law's page

• Determine whether you conduct business in Alabama or target products or services to Alabama residents, and control or process personal data of more than 25,000 Alabama consumers, or derive more than 25% of gross revenue from selling personal data, before relying on any APDPA exemption.
• Confirm whether a sector exemption applies. APDPA excludes political subdivisions of the state, higher-education institutions, GLBA- and HIPAA-regulated entities, businesses with fewer than 500 employees and nonprofit entities with fewer than 100 employees (neither may engage in the sale of personal data), political committees, and employment or business-to-business data.

Ala. HB 351, 2026 Regular Session, Secs. 5-6 · Read the law's page

• Give an Alabama consumer a means to confirm processing, access, correct, delete, and receive a portable copy of their personal data, free of charge once every 12 months.
• Offer an Alabama consumer an opt-out of targeted advertising, the sale of personal data, and profiling in furtherance of a solely automated decision with a significant effect.
• Respond to a consumer rights request within 45 days of receipt, with one 45-day extension available when reasonably necessary. This Act has no separate appeal-of-refusal mechanism.