Law / United States / 
Alabama
Alabama Personal Data Protection Act (HB 351), deidentified and pseudonymous data
Ala. HB 351, 2026 Regular Session, Sec. 9, Sec. 2(10), Sec. 2(18)
A de-identification rule binding private bodies.
- Obligation class
- Prohibition, Contract terms, Disclosure
- Audit expectation
- none
What it requires
- To treat data as deidentified under the Act, take reasonable measures to ensure that it cannot be associated with an individual and publicly commit to process it in a deidentified fashion only and not to attempt to reidentify it (Section 2(10)).
- If you are a controller in possession of deidentified data, take measures to ensure that the data cannot reasonably be associated with an individual (Section 9(a)(1)).
- Do not reidentify deidentified data when maintaining and using it (Section 9(a)(2)).
- Contractually obligate every recipient of deidentified data to comply with all provisions of Section 9 (Section 9(a)(3)).
- If you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments it is subject to, and take appropriate steps to address any breach of them (Section 9(e)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 9 and the definition in Section 2(10) state the conditions for treating data as deidentified and the duties of a controller that holds or discloses it. They require no log or record, and name no regulator. The scope clause is in Section 3, which this row does not cite, so no territorial hook is taken from it.
- Kind
- None
- As of
What this law does
APDPA Section 2(10) treats data as deidentified only if the controller that possesses it takes reasonable measures to ensure the data cannot be associated with an individual and publicly commits to process the data in a deidentified fashion only and not to attempt to reidentify it. APDPA Section 2(10)c also requires the controller that possesses the data to contractually obligate any recipients of the data to satisfy the criteria set forth in Section 11(a) and (b).
APDPA Section 9(a)(1) requires a controller in possession of deidentified data to take measures to ensure that the data cannot reasonably be associated with an individual. APDPA Section 9(a)(2) requires a controller in possession of deidentified data to refrain from reidentifying the data when maintaining and using it. APDPA Section 9(a)(3) requires a controller in possession of deidentified data to contractually obligate any recipients of the data to comply with all provisions of Section 9.
APDPA Section 9(e) requires a controller that discloses pseudonymous data or deidentified data to exercise reasonable oversight to monitor compliance with the contractual commitments to which the data is subject and to take appropriate steps to address any breaches of those commitments.
APDPA Section 9(d) provides that the consumer rights in Section 5 may not apply to pseudonymous data where the controller can demonstrate that the information needed to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing it. APDPA takes effect on under Section 12 of the Act.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .