House Bill 351 Alabama 2026 Session

Summary

Primary Sponsor

Mike ShawRepresentative

Republican

Session

2026 Regular Session

Title

Data privacy; processing of data regulated, consumer actions related to data authorized

Summary

HB351 would create the Alabama Personal Data Protection Act to give residents rights over their personal data and regulate how data is processed, with enforcement by the Attorney General.

What This Bill Does

The act would give Alabama residents the right to know if a controller is processing their personal data, access it, correct errors, delete it, obtain a portable copy, and opt out of processing. It would require controllers to provide a secure way to exercise these rights and to have an appeals process, and would allow the designation of an authorized agent. It would regulate how data is processed, set expectations for how data processors operate, cover deidentified data, and establish enforcement by the Attorney General.

Who It Affects

• Consumers (Alabama residents) would gain new rights over their personal data, including access, deletion, correction, portable copies, and the ability to opt out of processing; they may also designate an authorized agent to exercise these rights on their behalf.
• Controllers and processors that handle personal data of Alabama residents would face new obligations such as data minimization, security measures, rights handling, contracts between controllers and processors, and potential penalties for violations; some small businesses and certain regulated entities may be exempt.

Key Provisions

• Establishes the Alabama Personal Data Protection Act and defines consumer rights to confirm processing, access data, correct inaccuracies, delete data, obtain a portable copy, and opt out.
• Requires controllers to provide secure and reliable methods to exercise rights, maintain an appeals process, and allow designation of an authorized agent.
• Prohibits certain processing without consent such as targeted advertising or selling personal data, imposes data minimization and security requirements, and requires clear privacy notices.
• Sets timelines for responding to rights requests (generally within 45 days with a possible 45-day extension) and allows reasonable fees for manifestly unfounded or repetitive requests.
• Imposes duties on processors and requires written contracts that specify processing instructions, confidentiality, deletion or return of data, and subprocessor obligations.
• Authorizes enforcement by the Attorney General, provides a notice of violation process, allows civil penalties up to 15,000 per violation, and states there is no private right of action; effective date is October 1, 2026; includes various exemptions.

AI-generated summary using openai/gpt-5-nano on Feb 12, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Consumer Protection