Bill > HB283

This bill, known as the Alabama Personal Data Protection Act, establishes comprehensive data privacy regulations for businesses operating in Alabama or targeting Alabama residents. The bill applies to companies that control or process personal data of more than 50,000 consumers or more than 25,000 consumers while deriving over 25% of gross revenue from selling personal data. It provides consumers with significant rights regarding their personal information, including the ability to confirm what data is being processed, correct inaccuracies, delete their data, obtain a copy of their data, and opt out of targeted advertising, data sales, and certain automated profiling. Businesses must limit data collection to what is necessary, maintain data security, provide clear privacy notices, and obtain consent for processing sensitive data. The bill notably does not create a private right of action, meaning only the Attorney General can enforce violations, with a 60-day period for businesses to correct identified issues before potential fines of up to $10,000 per violation are assessed. The law will become effective on July 1, 2026, and includes numerous exemptions for certain types of organizations and data, such as financial institutions, healthcare entities, and research-related data. Importantly, the bill aims to give consumers more control over their personal information while providing a framework for businesses to responsibly handle data.

Business and Industry

https://alison.legislature.state.al.us/bill-search