HB351 Alabama 2026 Session

Summary

Primary Sponsor

Mike ShawRepresentative

Republican

Session

2026 Regular Session

Title

Data privacy; processing of data regulated, consumer actions related to data authorized

Summary

HB351 creates the Alabama Personal Data Protection Act to regulate how personal data is processed, give residents new rights over their data, and set enforcement.

What This Bill Does

It defines key terms and sets rules for how personal data can be processed by controllers and processors. It gives Alabama residents rights to access, delete, obtain a copy of their data, correct inaccuracies, and opt out of targeted advertising or the sale of their data; guardians can exercise these rights for known children. It requires entities to limit data collection to what is necessary, implement security measures, and provide clear privacy notices with contact information and rights. It establishes enforcement through the Attorney General, with notices of violation, potential injunctions, and penalties up to $15,000 per violation, and it specifies an effective date of May 1, 2027 plus an opt-out mechanism by 2028, along with various exemptions for certain entities and data.

Who It Affects

• Residents of Alabama (consumers) gain new rights over their personal data, and guardians may exercise rights on behalf of known children.
• Controllers and processors (companies and organizations that process personal data) must comply with limits on data collection, security requirements, privacy notices, and rights-claims processes; they may face enforcement and penalties for violations.
• Small businesses and nonprofits may be exempt or subject to the act based on size and data activities (e.g., under 500 employees not selling data; nonprofits under 100 employees not selling data).
• Certain governmental, health, financial, higher education, and regulated entities are largely exempt from the act.

Key Provisions

• Establishes the Alabama Personal Data Protection Act with defined terms such as controller, processor, personal data, biometric data, and deidentified data.
• Grants consumers rights to confirm processing, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising or the sale of personal data; guardians can exercise rights for known children.
• Requires controllers to limit data collection to what is necessary, implement security measures, and provide a clear privacy notice detailing data categories, purposes, sharing, contact information, and how to exercise rights.
• Mandates rights requests be authenticated and responded to within 45 days (with a possible 45-day extension) and allows certain fees for unfounded or excessive requests; establishes secure methods for submitting requests.
• Creates opt-out mechanisms including website links and an opt-out signal by 2028, with rules to handle conflicts with existing privacy settings and consumer loyalty programs.
• Regulates the processing of deidentified data, requiring measures to prevent reidentification and contractual obligations to ensure compliance; identifies when pseudonymous data is not subject to the full set of rights.
• Imposes processor-controller contract requirements, including confidentiality, deletion at end of service, and provision of information to demonstrate compliance; obligates subcontractors to meet these obligations.
• Gives enforcement authority to the Attorney General, including notices of violation, potential injunctions, and civil penalties up to $15,000 per violation; an effective date is May 1, 2027.

AI-generated summary using openai/gpt-5-nano on Feb 25, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Consumer Protection