Alabama Personal Data Protection Act (HB 351), general applicability and scope

Ala. HB 351, 2026 Regular Session, Secs. 1-4

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force in 220 days, effective 1 May 2027.

A comprehensive regime rule binding private bodies.

As of 27 August 2026.

What it requires

This Act does not yet bind. Its effective date is May 1, 2027; track compliance readiness against that date rather than treating APDPA as a current duty.
Once effective, determine whether you conduct business in Alabama or target products or services to Alabama residents, and control or process personal data of 25,000 or more Alabama consumers, or derive more than 25% of gross revenue from selling personal data, before relying on any APDPA exemption.
Confirm whether a sector exemption applies once the Act takes effect. APDPA excludes government bodies, higher-education institutions, Gramm-Leach-Bliley Act (GLBA)- and Health Insurance Portability and Accountability Act (HIPAA)-regulated entities, small nonprofits and businesses under the applicability threshold, political committees, and employment or business-to-business data.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

APDPA will govern private-sector processing of Alabama consumers' personal data once it takes effect on May 1, 2027. It applies to a person conducting business in Alabama, or targeting products or services to Alabama residents, who controls or processes personal data of 25,000 or more Alabama consumers, excluding payment-transaction-only data, or derives more than 25% of gross revenue from selling personal data.

Broad entity- and data-level exemptions apply, including government bodies, higher-education institutions, Gramm-Leach-Bliley Act (GLBA)- and Health Insurance Portability and Accountability Act (HIPAA)-regulated entities, small nonprofits and businesses under the applicability threshold, political committees, and employment or business-to-business data. 'Personal data' excludes deidentified data and publicly available information.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_biometrics
processes_voice

Read the law

enrolled bill text, Alabama Legislative Information System (ALISON)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app