Cybersecurity · Alabama law
Who the 2018 act covers, how the 45-day clock works and the reasonable security measures it expects. General information, not legal advice.
45 days to notify residents
Attorney General notice above 1,000
Reasonable security is a legal duty
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
The Alabama Data Breach Notification Act of 2018 (Ala. Code sections 8-38-1 to 8-38-12) applies to any business, nonprofit or government body that acquires or uses sensitive personal information about Alabama residents. If a breach is reasonably likely to cause substantial harm, you must notify affected people as quickly as possible and within 45 days. If more than 1,000 Alabamians are notified, you must also notify the Attorney General within 45 days and tell the credit bureaus. Vendors must report a breach to you within 10 days.
Alabama goes further than many states in one respect: it requires every covered entity to maintain reasonable security measures and lists what those measures should include. This article is general information, not legal advice. Confirm your obligations with counsel and your cyber insurer.
A covered entity is any person, sole proprietorship, partnership, corporation, nonprofit, trust or government entity that acquires or uses sensitive personally identifying information. Size does not matter. A 15-person accounting firm in Birmingham is covered the same way as a hospital system.
A third-party agent is a vendor that maintains, stores or processes that data for you, such as an IT provider, payroll service or cloud application. Agents have their own duties under the act and can face the same penalties if they fail to tell you about a breach.
Entities already regulated by federal breach rules, such as HIPAA, can be exempt from duplicate Alabama notices if they follow the federal process. If more than 1,000 Alabamians are notified, they must still send a copy to the Attorney General.
The act covers a first name or first initial and last name combined with any of these:
The list also includes a username or email address with a password or security question answer for an online account affiliated with your business that is likely to contain, or is used to obtain, sensitive personal information. Data that is truncated, encrypted or otherwise unusable is excluded, unless you know or have reason to know the encryption key or credential was taken too.
Section 8-38-3 says each covered entity and third-party agent “shall implement and maintain reasonable security measures.” The statute lists what that should include:
The law judges reasonableness by the size of the business, the amount and type of data and the cost of security relative to your resources. It puts the emphasis on failures that are multiple or systemic. A small firm is not expected to run an enterprise security program, but it is expected to have one person in charge and a short list of working controls.
Each individual notice must include the date or estimated date range of the breach, the type of information acquired, what you did to restore security, steps people can take to protect themselves from identity theft, and how to contact you. A written request from law enforcement can delay notice.
Could you show an investigator your reasonable security measures today? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, IT operations and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Only the Attorney General can enforce the act, and it creates no private right of action. A knowing violation of the notice rules, meaning willful or reckless, is subject to the penalties of the Alabama Deceptive Trade Practices Act, capped at $500,000 per breach. Separately, a covered entity that violates the notice provisions faces up to $5,000 a day for each consecutive day it fails to take reasonable action to comply.
When records with sensitive personal information are no longer needed, the act requires you to shred, erase or otherwise make them unreadable. That covers paper files, retired laptops, copier drives and old exports sitting in shared folders.
Alabama also enacted a broader privacy law in 2026. According to a June 2026 Seyfarth Shaw analysis, the Alabama Personal Data Protection Act was signed on April 17, 2026 and takes effect May 1, 2027. It applies to businesses that process data on more than 25,000 Alabama consumers or earn more than 25 percent of revenue from selling personal data, and businesses with fewer than 500 employees are exempt unless they sell personal data. Most small businesses will fall outside it, but the breach act applies to everyone.
JLB USA’s cybersecurity services cover these controls, including a written recovery plan and help with cyber-insurance questionnaires. We provide on-site IT in Birmingham and remote support everywhere else. For the backup side, see our guide to backup and disaster recovery for small businesses.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
The Alabama Data Breach Notification Act requires notice to affected individuals as expeditiously as possible and within 45 days of determining that a breach occurred and is reasonably likely to cause substantial harm, or of receiving notice from a vendor.
When more than 1,000 Alabama residents are notified, the Attorney General must also be notified within 45 days, with a synopsis, the approximate number affected, any free services offered and a contact person.
Yes. It covers any person or entity that acquires or uses sensitive personal information about Alabama residents, regardless of size. Reasonable security is judged partly by size and resources. This is general information; confirm with counsel.
Knowing violations of the notice rules can bring penalties under the Deceptive Trade Practices Act capped at $500,000 per breach, plus up to $5,000 a day for each day a covered entity fails to take reasonable action to comply. Only the Attorney General can enforce it.
Yes. A third-party agent must notify the covered entity without unreasonable delay and no later than 10 days after discovering a breach or having reason to believe one occurred.
