Alabama Personal Data Protection Act (HB 351), Attorney General enforcement

Ala. HB 351, 2026 Regular Session, Sec. 11

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force in 220 days, effective 1 May 2027.

An enforcement supervision rule binding private bodies.

As of 27 August 2026.

What it requires

This duty does not yet bind. APDPA's effective date is May 1, 2027.
Expect APDPA to be enforced exclusively by the Alabama Attorney General. It creates no private right of action.
Cure a noticed violation within 45 days and provide a written statement confirming the cure to avoid a civil penalty of not more than $15,000 per violation; the Attorney General must give this 45-day cure notice before bringing any enforcement action.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Once in force, the Alabama Attorney General will have exclusive authority to enforce APDPA. Before any enforcement action, the Attorney General must issue a written notice of violation to the controller; if the controller corrects the violation within 45 days and provides a written statement confirming the cure and that no further violations will occur, no action may be initiated. An uncured violation is subject to a court-assessed civil penalty of not more than $15,000 per violation. The Act creates no private right of action.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

enrolled bill text, Alabama Legislative Information System (ALISON)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app