Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Alabama |
|---|---|
| Statute citation | Ala. Code §§ 8-38-1 to 8-38-12 (Data Breach Notification Act of 2018) (amended 2018) |
| Individual notice timing | 45 days Alabama requires covered entities (including businesses) to notify affected individuals within 45 |
| Attorney general notice | Yes Alabama requires written notice to the Attorney General within 45 days when more than 1,000 |
| Biometric data | No |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Alabama 'breach of security' or 'breach' means the unauthorized acquisition of data in electronic form containing sensitive personally identifying information. Acquisition occurring over a period of time committed by the same entity constitutes one breach. The term does not include good faith acquisition by an employee or agent unless the information is used for an unrelated purpose or subject to further unauthorized use; the release of a public record not otherwise subject to confidentiality |