Law / United States / 
Alabama
Alabama Personal Data Protection Act (HB 351), general applicability and scope
Ala. HB 351, 2026 Regular Session, Secs. 1-4
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Determine whether you conduct business in Alabama or target products or services to Alabama residents, and control or process personal data of more than 25,000 Alabama consumers, or derive more than 25% of gross revenue from selling personal data, before relying on any APDPA exemption.
- Confirm whether a sector exemption applies. APDPA excludes government bodies, higher-education institutions, Gramm-Leach-Bliley Act (GLBA)- and Health Insurance Portability and Accountability Act (HIPAA)-regulated entities, small nonprofits and businesses under the applicability threshold, political committees, and employment or business-to-business data.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does a business with fewer than 500 employees "engage in the sale of personal data" under Section 4(a)(7) of the Alabama Personal Data Protection Act, and so lose that exemption, when it makes a single disclosure that meets the definition of sale in Section 2(20)?
What it makes you log
Logging duty
Sections 1 to 4 of HB 351 give the Act its title, its definitions, its scope and its exemptions, and none of them requires a controller to keep a log or a record. Section 3 brings in a person that conducts business in the state, or produces products or services targeted to residents of the state, and that meets a volume or revenue threshold. The record-like clauses of the Act sit in sections 5, 8 and 10 (a controller's documented belief about an opt-out request, a processor's information to show compliance, and a controller's burden of showing that processing qualifies for an exemption), and this row cites none of them.
- Kind
- None
- As of
What this law does
APDPA governs private-sector processing of Alabama consumers' personal data, with an effective date of . It applies to a person conducting business in Alabama, or targeting products or services to Alabama residents, who controls or processes personal data of more than 25,000 Alabama consumers, excluding payment-transaction-only data, or derives more than 25% of gross revenue from selling personal data.
Broad entity- and data-level exemptions apply, including government bodies, higher-education institutions, Gramm-Leach-Bliley Act (GLBA)- and Health Insurance Portability and Accountability Act (HIPAA)-regulated entities, small nonprofits and businesses under the applicability threshold, political committees, and employment or business-to-business data. 'Personal data' excludes deidentified data and publicly available information.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .