Law / United States / Alabama

Data Breach Notification Act, reasonable security measures and disposal of records

Ala. Code secs. 8-38-3, 8-38-10

In force since 1 Jun 2018.

A security baseline statutes rule binding public and private bodies.

Criminal exposure

No

Private right of action

No

Obligation class

Security, Retention

What it requires

• This binds any covered entity (a person, sole proprietorship, partnership, government entity, corporation, nonprofit, trust, estate, cooperative association, or other business entity that acquires or uses sensitive personally identifying information of an Alabama resident) and any third-party agent it contracts with to maintain, store, process, or access that information. An entity already subject to and complying with a federal or state data-breach-notification regime at least as thorough as this chapter is exempt from the entire chapter.
• Implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security: designate an employee or employees to coordinate the effort, identify internal and external risks, adopt and assess information safeguards, contractually require any service providers to maintain appropriate safeguards, adjust the measures for changed circumstances, and keep management, including the board of directors where one exists, informed of the overall status of the measures.NIST CSF 2.0PR.DS-01NIST CSF 2.0GV.RR-02NIST CSF 2.0GV.SC-05
• Take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.NIST CSF 2.0ID.AM-08
• There is no private right of action for a violation of either duty. Only the Attorney General may bring a civil action under the chapter, and the chapter's only stated civil-penalty amounts (up to $500,000 per breach, or $5,000 per day) are tied expressly to a violation of the chapter's separate notification provisions, not to this reasonable-security-measures or disposal duty; no distinct penalty figure or other enforcement mechanism is stated for either of these two duties.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

• ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
• CT.DM-P5Data are destroyed according to policy.
• PR.DS-P5Protections against data leaks are implemented.

NIST CSF 2.0

• GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
• GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
• ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
• PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected

CIS Controls

• 3.5Destroying data in a way that fits its sensitivity and storage type.
• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.
• 8.2Turning on and gathering logs from the enterprise's systems.

FINOS AIGF

• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest
• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance

3 more

• AIR-DET-001AI Data Leakage Prevention and Detection
• AIR-DET-004AI System Observability
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 2.1Risk management framework
• 3.1Incident handling policy
• 3.2Monitoring and logging
• 4.1Business continuity and disaster recovery plan
• 4.2Backup and redundancy management

6 more

• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure
• 9.1Cryptography
• 11.2Management of access rights
• 12.2Handling of assets

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated 15 September 2026.