Law / United States / 
Alabama
Alabama Personal Data Protection Act (HB 351), processor compliance information and the burden of showing an exemption
Ala. HB 351, 2026 Regular Session, Sec. 8(b)(3)c, Sec. 10(g)
A comprehensive regime rule binding private bodies.
- Obligation class
- Contract terms, Governance
- Audit expectation
- none
As of .
What it requires
- Include in every contract with a processor a requirement that the processor make available to you, on your reasonable request, all information in its possession necessary to demonstrate its compliance with the obligations of the Act.
- If you process personal data under an exemption in section 10 of the Act, be able to demonstrate that the processing qualifies for the exemption and complies with the requirements of that section.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Counterparty
Logging duty
Section 8(b)(3)c makes the contract between a controller and a processor require the processor to make available to the controller, on the controller's reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the obligations of the Act. A processor cannot meet that without records of its processing, but the text names no log, field or period, so no contents or retention are taken, and the access is the controller's under the contract; section 8 names no regulator. Section 10(g) makes a controller that processes personal data under an exemption in section 10 bear the burden of demonstrating that the processing qualifies for the exemption and complies with that section's requirements, which a controller can carry only from a record of the basis for the exemption it relied on; the text names no field or period, and no authority to whom the showing is made. Sections 8(b)(2) and 8(b)(3)b state the contract's terms and the deletion or return of data, and name no record. The scope clause is in section 3, which this row does not cite, so no territorial hook is taken from it.
- Kind
- Implicit
- As of
- Provision
- HB 351 section 8(b)(3)c (a processor makes available the information needed to demonstrate its compliance) and section 10(g) (a controller's burden of showing that processing qualifies for an exemption)
- Trigger
- personal_data_processing
What this law does
APDPA requires the contract between a controller and a processor to require the processor to make available to the controller, on the controller's reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the obligations of the Act.
A controller that processes personal data under an exemption in section 10 bears the burden of demonstrating that the processing qualifies for the exemption and complies with the requirements of that section.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes biometric data or processes voice recordings.