APDPA

The Alabama Personal Data Protection Act (APDPA) is Alabama's comprehensive consumer privacy law. It takes effect on 1 May 2027. Like the other state laws built on the same model, it gives Alabama residents rights over their personal data and puts duties on the businesses that decide how that data is used (controllers) and on the vendors that handle it for them (processors).

Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.

• Businesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
• The thresholds usually turn on how many Alabama residents' personal data a business handles in a year, and whether it earns revenue from selling personal data. Check the statute for the exact figures.
• Like most state privacy laws, it exempts some organizations and data, commonly including data already covered by HIPAA or the Gramm-Leach-Bliley Act, and data about people acting in an employment or commercial capacity.

Alabama residents can generally ask a business to confirm and access their personal data, correct it, delete it and get a copy in a portable format, and can opt out of targeted advertising, the sale of their data, and profiling that produces legal or similarly significant effects. Businesses generally have 45 days to respond, extendable once. Residents can usually appeal a refusal.

Enforced by the Alabama Attorney General (no private right of action). Violations carry civil penalties set by the statute. 45-day cure period.

1. Check the thresholds against your Alabama consumer numbers and any data sales.
2. Map the personal and sensitive data you hold about Alabama residents.
3. Update your privacy notice and add the opt-out routes the law requires.
4. Set up requests and appeals within the response deadlines.
5. Put APDPA-ready terms in processor contracts.
6. Build one program for all state laws, then add Alabama's departures.