1. Home
  2. State breach laws
  3. Alabama

Alabama data breach notification law

What Alabama requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Ala. Code § 8-38-1 et seq. (Alabama Data Breach Notification Act of 2018, Act 2018-396).

45 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Alabama's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Alabama breach filings →

Requirements in detail

Statute
Ala. Code § 8-38-1 et seq. (Alabama Data Breach Notification Act of 2018, Act 2018-396)
Deadline to notify residents
As quickly as possible and without unreasonable delay, but no later than 45 days after the entity determines that a breach occurred and is reasonably likely to cause substantial harm, or 45 days after it receives notice of the breach from a third-party agent. A federal or state law enforcement agency can delay notice by written request.
Attorney General notification
Yes, if more than 1,000 Alabama residents must be notified. The Attorney General must be notified within the same 45-day window. Nationwide consumer reporting agencies must also be notified without unreasonable delay when more than 1,000 people are notified at one time.
Penalties
A violation is an unlawful trade practice under the Alabama Deceptive Trade Practices Act, and the Attorney General has exclusive authority to bring an action for civil penalties. Knowing violations are subject to the Deceptive Trade Practices Act's civil penalties, capped at $500,000 per breach, and an entity that fails to take reasonable action to comply can also face up to $5,000 per day. Government entities are exempt from civil penalties.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Alabama's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Alabama has no law limiting breach lawsuits for organizations that maintain a security program.

Alabama breach notification FAQ

What is the data breach notification deadline in Alabama?

As quickly as possible and without unreasonable delay, but no later than 45 days after the entity determines that a breach occurred and is reasonably likely to cause substantial harm, or 45 days after it receives notice of the breach from a third-party agent. A federal or state law enforcement agency can delay notice by written request. The governing law is Ala. Code § 8-38-1 et seq. (Alabama Data Breach Notification Act of 2018, Act 2018-396).

Does Alabama require notifying the Attorney General of a data breach?

Yes, if more than 1,000 Alabama residents must be notified. The Attorney General must be notified within the same 45-day window. Nationwide consumer reporting agencies must also be notified without unreasonable delay when more than 1,000 people are notified at one time.

What are the penalties for failing to report a data breach in Alabama?

A violation is an unlawful trade practice under the Alabama Deceptive Trade Practices Act, and the Attorney General has exclusive authority to bring an action for civil penalties. Knowing violations are subject to the Deceptive Trade Practices Act's civil penalties, capped at $500,000 per breach, and an entity that fails to take reasonable action to comply can also face up to $5,000 per day. Government entities are exempt from civil penalties.

Can individuals sue over a data breach in Alabama?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Alabama?

Alabama's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Alabama limit breach lawsuits for companies with a cybersecurity program?

No. Alabama has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Alabama Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →