Alabama Personal Data Protection Act (APDPA)
Enacted Alabama · In force May 1, 2027 · next deadline May 1, 2027 (in 7 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.
- Who it applies to
- Persons doing business in Alabama or targeting residents that control or process personal data of more than 25,000 consumers (excluding payment-only data), or derive more than 25% of gross revenue from the sale of personal data regardless of volume. Exempts businesses with fewer than 500 employees and nonprofits with fewer than 100 employees that do not sell personal data.
- Penalties
- Civil penalty up to $15,000 per violation, only after the controller fails to correct within the permanent 45-day notice-and-cure period; injunctive relief. No private right of action.
- Enforced by
- Alabama Attorney General (exclusive)
- Official name
- Alabama Personal Data Protection Act (HB 351, 2026 Regular Session)
- Citation
- HB 351 (2026 RS), Act 2026-552
- Topics
- privacy
Research notes
Fact-check 2026-09-22: the official ALISON record lists HB 351 as Act 2026-552, delivered to the Governor 8 Apr 2026 and 'Enacted' 17 Apr 2026; enacted_date uses the official 17 Apr 2026 date (WilmerHale and Privacy Daily reported signing on 16 Apr 2026). Enrolled text Section 12: effective 1 May 2027. The 45-day cure period is permanent, so no cure-expiry deadline.
Related
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)
Florida Digital Bill of RightsQuestions about Alabama Personal Data Protection Act (APDPA)
- What are the Alabama Personal Data Protection Act (APDPA) compliance deadlines?
- May 1, 2027: APDPA takes effect.
- When does Alabama Personal Data Protection Act (APDPA) take effect?
- Alabama Personal Data Protection Act (APDPA) takes effect on May 1, 2027. The next milestone is May 1, 2027: APDPA takes effect.
- Who does Alabama Personal Data Protection Act (APDPA) apply to?
- Persons doing business in Alabama or targeting residents that control or process personal data of more than 25,000 consumers (excluding payment-only data), or derive more than 25% of gross revenue from the sale of personal data regardless of volume. Exempts businesses with fewer than 500 employees and nonprofits with fewer than 100 employees that do not sell personal data.
- What are the penalties under Alabama Personal Data Protection Act (APDPA)?
- Civil penalty up to $15,000 per violation, only after the controller fails to correct within the permanent 45-day notice-and-cure period; injunctive relief. No private right of action.