AL · Breach notification statute
Alabama data breach notification law
Summary
- Statute citation
Ala. Code §§ 8-38-1 to 8-38-12 (Data Breach Notification Act of 2018) (amended 2018)
- Last amended
- 2018 (as stated in the citation)
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
45 days Alabama requires covered entities (including businesses) to notify affected individuals within 45
Attorney general notice
Yes Alabama requires written notice to the Attorney General within 45 days when more than 1,000
What counts as a breach
In Alabama 'breach of security' or 'breach' means the unauthorized acquisition of data in electronic form containing sensitive personally identifying information. Acquisition occurring over a period of time committed by the same entity constitutes one breach. The term does not include good faith acquisition by an employee or agent unless the information is used for an unrelated purpose or subject to further unauthorized use; the release of a public record not otherwise subject to confidentiality
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Alabama
101 reports to HHS OCR affecting 14,149,604 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Alabama.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Aesto, LLC | Business Associate | 9,540,683 | Jul 31, 2026 | Hacking/IT Incident | Under investigation |
| Sutter Medical Foundation | Healthcare Provider | 943,434 | Nov 17, 2011 | Theft | Archive (closed) |
| Upstream RollCo, LLC | Healthcare Provider | 748,678 | Apr 22, 2023 | Hacking/IT Incident | Archive (closed) |
| Cardiovascular Associates | Healthcare Provider | 433,348 | Feb 3, 2023 | Hacking/IT Incident | Archive (closed) |
| Sarrell Dental | Healthcare Provider | 363,617 | Sep 12, 2019 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Alabama businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Alabama timing rule as: "45 days Alabama requires covered entities (including businesses) to notify affected individuals within 45". (Source: PRC 2026 survey extract.)
Does Alabama require notice to the attorney general?
The PRC 2026 extract notes: "Yes Alabama requires written notice to the Attorney General within 45 days when more than 1,000". (Source: PRC 2026 survey extract.)
Does the Alabama law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Alabama breach law.
Does the Alabama law cover medical information?
Yes. The PRC 2026 survey records medical information as covered by the Alabama breach law.
Does the Alabama law cover paper records?
No. The PRC 2026 survey records the Alabama law as covering computerised data only, not paper records.
Is there a private right of action in Alabama?
No. The PRC 2026 survey does not record a private right of action under the Alabama breach law.
Is credit monitoring required in Alabama?
No. The PRC 2026 survey does not record a credit monitoring requirement in Alabama.
How does the Alabama law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Alabama statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Alabama state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws