Law / United States / 
Alabama
Alabama Personal Data Protection Act (HB 351), Attorney General enforcement
Ala. HB 351, 2026 Regular Session, Sec. 11
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect the Alabama Attorney General to enforce APDPA violations under Section 11. The Act creates no private right of action.
- Cure a noticed violation within 45 days and provide a written statement confirming the cure to avoid a civil penalty of not more than $15,000 per violation; the Attorney General must give this 45-day cure notice before bringing any enforcement action.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does 'per violation' in Section 11(b)(2) of the Alabama Personal Data Protection Act count each affected consumer, each unanswered request or each unlawful processing practice when a court assesses a civil penalty of not more than $15,000?
What it makes you log
Logging duty
Section 11 lets the Attorney General enforce the Act after a notice of violation and a 45-day period to cure. A controller that cures gives the Attorney General an express written statement that the violations were corrected, which is a statement to the authority and not a record the controller keeps. Section 11 gives the Attorney General no power to inspect or demand records and sets no retention period. The scope clause in section 3 is not cited, so no territorial hook is taken from it.
- Kind
- None
- As of
What this law does
The Alabama Attorney General may enforce violations of APDPA. Before any enforcement action, the Attorney General must issue a written notice of violation to the controller; if the controller corrects the violation within 45 days and provides a written statement confirming the cure and that no further violations will occur, no action may be initiated. An uncured violation is subject to a court-assessed civil penalty of not more than $15,000 per violation. The Act creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .