Alabama Data Breach Notification Law

The Alabama data breach notification law and its 45-day ceiling

Alabama's 2018 act starts a 45-day count once the business determines a breach happened and is reasonably likely to cause substantial harm ²³. Only electronic records are covered, so a misplaced carton of paper files is outside it ¹.

Day 45 is a backstop. Letters should go as fast as possible and without unreasonable delay, and police can request a hold ¹. A dated log of what you learned and when lets you show the timeline later. The act also demands reasonable security and secure disposal of records, both of which belong in a WISP.

The harm test and the five-year paper trail

Letters are owed only for a breach reasonably likely to cause substantial harm to the people whose data it is ². That leaves room to conclude a minor incident needs none, at a price: the no-notice decision goes in writing and the records stay on file at least five years ².

Write it as if a regulator will read it, built on forensic findings and reviewed by counsel.

Encrypted, truncated or otherwise unusable data is exempt, unless the business knows or should know the key or security credential was compromised too ¹.

The Attorney General and your vendors

More than 1,000 residents to notify means a written notice to the Attorney General, as fast as possible and within 45 days ³.

Service providers get less time. A third-party agent holding your data must tell you without unreasonable delay and within 10 days of determining a breach ¹, and your own 45 days then run from that notice ².

Taxpayer ID, passport and military ID numbers, medical and health insurance details, and online account logins are all protected ¹. Scope an incident across HR, benefits and email, not just payment systems. A phished mailbox that holds scanned passports or benefit forms can matter as much as a stolen card list.

The 10-day vendor rule deserves a line in every contract. Ask your managed IT provider, payroll service and cloud software vendors to confirm in writing that they will report a breach to you within 10 days, and name the person they should call. Your 45 days may start the moment their notice arrives.

Penalties of up to $500,000 per breach

Civil penalties come only from the Attorney General: up to $500,000 per breach for knowing violations, and up to $5,000 for each day a business fails to take reasonable steps to comply ¹. Violations are unlawful trade practices under the Alabama Deceptive Trade Practices Act, not crimes ¹, and consumers cannot sue under the statute ⁴.

If your Alabama business is breached

During a live attack, sequence matters for an insured Alabama firm: carrier's claim line, then an online report to the FBI's IC3, and no reimaging until evidence is safe ⁵⁶⁷. Policies often dictate the law firm, so ask before hiring; typical carrier conditions lists them.

Then your outside IT contractor or a response specialist contains the incident. Sort the affected list by home state early: Georgia and Tennessee apply their own rules, and the deadline for every state is in our table.

The Alabama act was last checked against this summary on October 13, 2026. This plain-language page is no substitute for legal advice, so have Alabama counsel review any no-notice decision before it goes into the five-year file.