Alabama Privacy Law

Alabama (APDPA)

Last updated Sep 29, 2026

APDPA Enacted, not yet effective

Who this affects: This page tracks Alabama’s APDPA, which governs controllers and processors.

Who it applies to: Persons that do business in Alabama or target its residents, and meet: more than 25,000 consumers, or more than 25% of gross revenue from selling data.

Content on this page is not legal advice

Must, Can't, Should APDPA Timeline

APDPA takes effect

days

hrs

min

sec

May 1, 2027 · live countdown

May 1, 2027

Effective ↗

Attorney General

Enforced by ↗

$15,000

Maximum penalty per violation ↗

No private right of action.

Private right of action ↗

The law, in plain English

Must · Can’t · Should

APDPA, distilled to what actually changes your week. Read one column to know your floor, your hard limits, and the further obligations and good practices worth planning for.

Must

Respond within 45 days to authenticated requests to access, correct, delete, or port personal data, or to opt out. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 5 “A controller shall comply with an authenticated request to do any of the” Read the statute Ala. HB 351 (2026) § 5 “A controller shall respond to a consumer's request within 45 days of receipt of the request.” Read the statute Ala. HB 351 (2026) § 5 “Confirm whether a controller, or a processor or third party acting on a controller's behalf, is processing the consumer's personal data and accessing any of the consumer's personal data under the control of the controller, unless confirmation or access would require the controller to reveal a trade secret.” Read the statute Ala. HB 351 (2026) § 5 “Correct inaccuracies in the consumer's personal data, considering the nature of the personal data and the purposes of the processing of the consumer's personal data.” Read the statute Ala. HB 351 (2026) § 5 “Direct a controller to delete the consumer's personal data.” Read the statute Ala. HB 351 (2026) § 5 “Obtain a copy of the consumer's personal data previously provided by the consumer to a controller in a portable and, to the extent technically feasible, readily usable format” Read the statute Ala. HB 351 (2026) § 5 “The sale of the consumer's personal data.” Read the statute Ala. HB 351 (2026) § 5 “Targeted advertising.” Read the statute
Offer a clear and conspicuous website link to an opt-out page for targeted ads and sale, or up-to-date contact information. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 6 “A controller must allow a consumer to opt-out by providing a clear and conspicuous link on the controller's Internet website to an Internet web page that enables a consumer directly to opt out” Read the statute Ala. HB 351 (2026) § 6 “(b) A controller must allow a consumer to opt-out by providing a clear and conspicuous link on the controller's Internet website to an Internet web page that enables a consumer directly to opt out of any processing of the consumer's personal data for the purposes of targeted advertising or sale of the consumer's personal data, or provides up-to-date contact information for a consumer to submit the opt-out request.” Read the statute
Use a binding processor contract setting instructions, nature and purpose, data type, duration, and parties' rights and duties. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 8 “A contract between a controller and a processor shall govern the processor's data processing obligations with respect to processing performed on behalf of the controller. (2) The contract shall: a. Be binding; b. Clearly set forth instructions for processing data; c. Clearly set forth the nature and purpose of the processing; d. Clearly set forth the type of data subject to processing; e. Clearly set forth the duration of processing; and f. Clearly set forth the rights and obligations of both parties.” Read the statute

Can't

Sell or target ads using data of a consumer you actually know is at least 13 but younger than 16 years of age without consent. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 7 “Process the personal data of a consumer for the purposes of targeted advertising or sell a consumer's personal data without the consumer's consent under circumstances in which a controller has actual knowledge that the consumer is at least 13 years of age but younger than 16 years of age.” Read the statute
Process sensitive data without consent, or a known child's personal data other than in accordance with COPPA. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 7 “Process sensitive data concerning a consumer other than a known child without obtaining that consumer's consent or, in the case of the processing of personal data concerning a known child, without processing the data in accordance with the federal Children's Online Privacy Protection Act of 1998, 15 U.S.C. § 6501 et seq.” Read the statute
Deny service, charge more, or cut quality for opting out, except in a bona fide loyalty, rewards, or similar program. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 7 “Deny goods or services, charge different prices or rates for goods or services, or provide a different level of quality of goods or services to a consumer if the consumer opts out of the processing of the consumer's data. However, if a consumer opts out of data processing, the covered entity is not required to provide a service that requires data processing. Controllers may provide different prices or levels for goods or services if the good or service is a bona fide loyalty, rewards, premium features, discount, or club card program in which a consumer voluntarily participates.” Read the statute

Should

Run a 45-day clock from receipt on every request, so extension notices and reasons for declining go out within that window. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 5 “A controller shall respond to a consumer's request within 45 days of receipt of the request.” Read the statute Ala. HB 351 (2026) § 5 “the controller shall inform the consumer of the justification for declining to act within 45 days of receipt of the request.” Read the statute Ala. HB 351 (2026) § 5 “the consumer of the extension and the reason for the extension within the initial 45-day response period” Read the statute
Make revoking consent as easy as giving it; stop processing as soon as practicable, within 45 days of complying with the opt-out. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 7 “Provide an effective mechanism for a consumer to revoke the consumer's consent under this act that is at least as easy as the mechanism by which the consumer provided the consumer's consent and, on revocation of the consent, cease to further process the personal data as soon as practicable, but no later than 45 days after complying with the consumer's opt-out request consistent with this act.” Read the statute
Before the act takes effect on May 1, 2027, publish a privacy notice describing secure, reliable ways to submit rights requests. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Ala. HB 351 (2026) § 12 “This act shall become effective on May 1, 2027.” Read the statute Ala. HB 351 (2026) § 7 “A controller shall establish and describe in a privacy notice one or more secure and reliable means for consumers to submit a request to exercise their consumer rights” Read the statute

These are the highlights we judge most important, not everything APDPA requires. The comprehensive law section below covers the full detail, fact by fact, with the statutory text behind every one.

The comprehensive law

Alabama Personal Data Protection Act

APDPA (HB 351) is Alabama’s comprehensive privacy law. Every fact was extracted from the primary statute by the DataGrail regulation engine and is grounded to the cited source. Scan the facts; the exact statutory text sits one click away on each source link.

Status

Enacted, not yet effective

Archived excerpt — the text we read Section 12. This act shall become effective on May 1, 2027. ____________________________________________… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source

Effective

May 1, 2027

Signed

April 16, 2026

“Signed by Governor Yes Approved Date and Time 4-16-2026 10:50 AM Received Date and Time 4-16-2026 12:18 PM” View the source

Enforced by

Attorney General

Archived excerpt — the text we read Section 11. (a) The Attorney General may enforce violations of this act. (b)(1) The Attorney General, prior to initiating any action for a violation of any provision of this act, shall issue a notice of violation to the controller. (2) If the controller fails to corre… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source

Maximum penalty per violation

$15,000

“the court may assess a civil penalty of not more than fifteen thousand dollars ($15,000) per violation” View the statute

Right to cure

45 days (from May 1, 2027)

The AG must give notice first; no action if the violation is cured within 45 days with a written statement. Archived excerpt — the text we read … enforce violations of this act. (b)(1) The Attorney General, prior to initiating any action for a violation of any provision of this act, shall issue a notice of violation to the controller. (2) If the controller fails to correct the violation within 45 days after receipt of the notice of violation, the Attorney General may bring an action for an injunction pursuant to this section. Upon a finding that the controller has violated this act and failed to correct the violation as required by this section, the court may assess a civil penalty of not mor… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source

Private right of action

No private right of action.

Corroborated by Privacy-law tracker

Universal opt-out signal

Not required

Archived excerpt — the text we read …mer may act on the known child's or the consumer's behalf to opt out of the processing of the known child's or the consumer's personal data for one or more of the purposes specified in Section 5. (b) A controller must allow a consumer to opt-out by providing a clear and conspicuous link on the controller's Internet website to an Internet web page that enables a consumer directly to opt out of any processing of the consumer's personal data for the purposes of targeted advertising or sale of the consumer's personal data, or provides up-to-date contact information for a consumer to submit the opt-out request. (c)(1) If a consumer's decision to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of personal data, through an opt-out preference … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source

What the law gives consumers

Right to access Archived excerpt — the text we read …ny time by submitting a request to a controller specifying the consumer right the consumer seeks to invoke. A controller shall comply with an authenticated request to do any of the following: (1) Confirm whether a controller, or a processor or third party acting on a controller's behalf, is processing the consumer's personal data and accessing any of the consumer's personal data under the control of the controller, unless confirmation or access would require the controller to reveal a trade secret. (2) Correct inaccuracies in the consumer's personal data, considering the nature of the personal data and the purposes of the processing of the consumer's personal data. (3) Direct a controll… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Right to correct Archived excerpt — the text we read …mer's personal data and accessing any of the consumer's personal data under the control of the controller, unless confirmation or access would require the controller to reveal a trade secret. (2) Correct inaccuracies in the consumer's personal data, considering the nature of the personal data and the purposes of the processing of the consumer's personal data. (3) Direct a controller to delete the consumer's personal data. (4) Obtain a copy of the consumer's personal data previously provided by the consumer to a controller in a portable and, to the… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Right to delete Archived excerpt — the text we read … a trade secret. (2) Correct inaccuracies in the consumer's personal data, considering the nature of the personal data and the purposes of the processing of the consumer's personal data. (3) Direct a controller to delete the consumer's personal data. (4) Obtain a copy of the consumer's personal data previously provided by the consumer to a controller in a portable and, to the extent technically feasible, readily usable format that allows the … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Right to data portability Archived excerpt — the text we read …sonal data, considering the nature of the personal data and the purposes of the processing of the consumer's personal data. (3) Direct a controller to delete the consumer's personal data. (4) Obtain a copy of the consumer's personal data previously provided by the consumer to a controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the personal data to another controller without hindrance when the processing is carried out by automated means, unless the provision of the… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Right to opt out of sale Archived excerpt — the text we read …of the data would require the controller to reveal a trade secret. (5) Opt out of the processing of the consumer's personal data for any of the following purposes: a. Targeted advertising. b. The sale of the consumer's personal data. c. Profiling in furtherance of solely automated significant decisions concerning the consumer. (b) A controller shall establish a secure and reliable method for a consumer to exercise rights esta… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Right to opt out of targeted advertising Archived excerpt — the text we read …ns, unless the provision of the data would require the controller to reveal a trade secret. (5) Opt out of the processing of the consumer's personal data for any of the following purposes: a. Targeted advertising. b. The sale of the consumer's personal data. c. Profiling in furtherance of solely automated significant decisions concerning the consumer. (b) A controller shall establish a secure and reliable … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Right to opt out of profiling for solely automated significant decisions Archived excerpt — the text we read …a trade secret. (5) Opt out of the processing of the consumer's personal data for any of the following purposes: a. Targeted advertising. b. The sale of the consumer's personal data. c. Profiling in furtherance of solely automated significant decisions concerning the consumer. (b) A controller shall establish a secure and reliable method for a consumer to exercise rights established by this section and shall describe the method in the controller's privacy notice. … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Sensitive data: opt-in consent required Archived excerpt — the text we read …act, process personal data for purposes that are not reasonably necessary to or compatible with the disclosed purposes for which the personal data is processed as disclosed by the controller. (2) Process sensitive data concerning a consumer other than a known child without obtaining that consumer's consent or, in the case of the processing of personal data concerning a known child, without processing the data in accordance with the federal Children's Online Privacy Protection Act of 1998, 15 U.S.C.… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Right against discrimination (limited) Protects only consumers who opt out of processing. A service that requires the processing need not be provided, and bona fide voluntary loyalty, rewards, premium or discount programs may differ. Archived excerpt — the text we read …without the consumer's consent under circumstances in which a controller has actual knowledge that the consumer is at least 13 years of age but younger than 16 years of age. (5) Deny goods or services, charge different prices or rates for goods or services, or provide a different level of quality of goods or services to a consumer if the consumer opts out of the processing of the consumer's data. However, if a consumer opts out of data processing, the covered entity is not required to provide a service that requires data processing. Controllers may provide different prices or levels for g… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Not granted: Private right of action Archived excerpt — the text we read Section 11. (a) The Attorney General may enforce violations of this act. (b)(1) The Attorney General, prior to initiating any action for a violation of any provision of this act, shall issue a notice of violation to the controller. (2) If the controller fails to corre… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source

Who the law governs

Controllers Archived excerpt — the text we read …er over the election of a majority of the directors or of individuals exercising similar functions. c. The power to exercise controlling influence over the management of a company. (8) CONTROLLER. An individual or legal entity that, alone or jointly with others, determines the purposes and means of processing personal data. (9) DARK PATTERN. A user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decision-making, or choice. (10) DEIDENTIFIED DATA. Data that cannot… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Processors Archived excerpt — the text we read …on personal data or on sets of personal data, including, but not limited to, the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. (16) PROCESSOR. An individual or legal entity that processes personal data on behalf of a controller. (17) PROFILING. Any form of solely-automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situa… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source

Exemptions

Political subdivisions of the state Archived excerpt — the text we read Section 4. (a) Notwithstanding any other provisions of this act, this act shall not apply to any of the following: (1)a. A political subdivision of the state. b. Any board, authority, district, or public corporation organized pursuant to Title 11, Code of Alabama 1975, or Chapter 7 of Title 39, Code of Alabama 1975. (2) A two-year or four-year institut… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Public boards/authorities/districts organized under Title 11 or Chapter 7 of Title 39 Archived excerpt — the text we read Section 4. (a) Notwithstanding any other provisions of this act, this act shall not apply to any of the following: (1)a. A political subdivision of the state. b. Any board, authority, district, or public corporation organized pursuant to Title 11, Code of Alabama 1975, or Chapter 7 of Title 39, Code of Alabama 1975. (2) A two-year or four-year institution of higher education, including affiliates of a two-year or four-year institution of higher education. (3) A national securities association that is reg… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Institutions of higher education Archived excerpt — the text we read …itical subdivision of the state. b. Any board, authority, district, or public corporation organized pursuant to Title 11, Code of Alabama 1975, or Chapter 7 of Title 39, Code of Alabama 1975. (2) A two-year or four-year institution of higher education, including affiliates of a two-year or four-year institution of higher education. (3) A national securities association that is registered under 15 U.S.C. § 78o-3. (4) A financial institution or an affiliate of a financial institution governed by 15 U.S.C. Chapter 94. (5) … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
National securities associations registered under 15 U.S.C. § 78o-3 Archived excerpt — the text we read … Chapter 7 of Title 39, Code of Alabama 1975. (2) A two-year or four-year institution of higher education, including affiliates of a two-year or four-year institution of higher education. (3) A national securities association that is registered under 15 U.S.C. § 78o-3. (4) A financial institution or an affiliate of a financial institution governed by 15 U.S.C. Chapter 94. (5) A financial institution or an affiliate of a financial institution governed by, or per… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Financial institutions and their affiliates governed by 15 U.S.C. ch. 94 GLBA privacy provisions; entity-level. Archived excerpt — the text we read …ion of higher education, including affiliates of a two-year or four-year institution of higher education. (3) A national securities association that is registered under 15 U.S.C. § 78o-3. (4) A financial institution or an affiliate of a financial institution governed by 15 U.S.C. Chapter 94. (5) A financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with Title V of the Gramm-Leach-Bliley … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
GLBA financial institutions and GLBA data Entity- and data-level Financial institutions/affiliates and personal data processed in accordance with GLBA Title V (entity- and data-level). Archived excerpt — the text we read … (3) A national securities association that is registered under 15 U.S.C. § 78o-3. (4) A financial institution or an affiliate of a financial institution governed by 15 U.S.C. Chapter 94. (5) A financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et. seq. (6) A covered entity or business associate as defined in the privacy regulations of 45 C.F.R. § 160.103. (7) A business, including an organization cooperatively organized under Chapter 6 of Title 37,… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
HIPAA covered entities and business associates Archived excerpt — the text we read …e of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et. seq. (6) A covered entity or business associate as defined in the privacy regulations of 45 C.F.R. § 160.103. (7) A business, including an organization cooperatively organized under Chapter 6 of Title 37, Code of Alabama 1975, or an entity that is an instrumentality of a municipal corpor… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Businesses with fewer than 500 employees that do not sell personal data Incl. Title 37 ch. 6 cooperatives and municipal instrumentalities. Archived excerpt — the text we read …closed in accordance with Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et. seq. (6) A covered entity or business associate as defined in the privacy regulations of 45 C.F.R. § 160.103. (7) A business, including an organization cooperatively organized under Chapter 6 of Title 37, Code of Alabama 1975, or an entity that is an instrumentality of a municipal corporation, with fewer than 500 employees, provided the business does not engage in the sale of personal data. (8) A nonprofit entity, as defined in Section 10A-1-1.03, Code of Alabama 1975, with less than 100 employees, provided the entity does not engage in the sale of personal data. … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Nonprofit entities with fewer than 100 employees that do not sell personal data As defined in Section 10A-1-1.03. Archived excerpt — the text we read …, or an entity that is an instrumentality of a municipal corporation, with fewer than 500 employees, provided the business does not engage in the sale of personal data. (8) A nonprofit entity, as defined in Section 10A-1-1.03, Code of Alabama 1975, with less than 100 employees, provided the entity does not engage in the sale of personal data. (9) Any person or entity regulated by Chapter 6 of Title 8, Code of Alabama 1975. (10) Any person or entity regulated by Chapter 7A of Title 8, Code of Alabama 1975. (11) Any trade association expl… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Persons regulated by Chapter 6 of Title 8, Code of Alabama 1975 Archived excerpt — the text we read …(8) A nonprofit entity, as defined in Section 10A-1-1.03, Code of Alabama 1975, with less than 100 employees, provided the entity does not engage in the sale of personal data. (9) Any person or entity regulated by Chapter 6 of Title 8, Code of Alabama 1975. (10) Any person or entity regulated by Chapter 7A of Title 8, Code of Alabama 1975. (11) Any trade association explicitly authorized to receive documents or evidence pursuant to Section 27-12A-23, Code of Al… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Persons regulated by Chapter 7A of Title 8, Code of Alabama 1975 Archived excerpt — the text we read …5, with less than 100 employees, provided the entity does not engage in the sale of personal data. (9) Any person or entity regulated by Chapter 6 of Title 8, Code of Alabama 1975. (10) Any person or entity regulated by Chapter 7A of Title 8, Code of Alabama 1975. (11) Any trade association explicitly authorized to receive documents or evidence pursuant to Section 27-12A-23, Code of Alabama 1975. (12)a. A political action committee, political party, or pri… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Trade associations authorized under Section 27-12A-23 Archived excerpt — the text we read …le of personal data. (9) Any person or entity regulated by Chapter 6 of Title 8, Code of Alabama 1975. (10) Any person or entity regulated by Chapter 7A of Title 8, Code of Alabama 1975. (11) Any trade association explicitly authorized to receive documents or evidence pursuant to Section 27-12A-23, Code of Alabama 1975. (12)a. A political action committee, political party, or principal campaign committee, as defined in Section 17-5-2, Code of Alabama 1975, or any political organization as defined in 26 U.S.C. §5… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Political action committees, political parties, and political organizations Archived excerpt — the text we read …y regulated by Chapter 7A of Title 8, Code of Alabama 1975. (11) Any trade association explicitly authorized to receive documents or evidence pursuant to Section 27-12A-23, Code of Alabama 1975. (12)a. A political action committee, political party, or principal campaign committee, as defined in Section 17-5-2, Code of Alabama 1975, or any political organization as defined in 26 U.S.C. §527. b. A business entity that sells data primarily to a political action committee, political party, or principal campaign committee, as defined in Section 17-5-2, Code of Alabama 1975, or any politi… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Businesses selling data primarily to political organizations Archived excerpt — the text we read … A political action committee, political party, or principal campaign committee, as defined in Section 17-5-2, Code of Alabama 1975, or any political organization as defined in 26 U.S.C. §527. b. A business entity that sells data primarily to a political action committee, political party, or principal campaign committee, as defined in Section 17-5-2, Code of Alabama 1975, or any political organization as defined in 26 U.S.C. §527. (13) An electric provider as defined under Chapter 16 of Title 37, Code of Alabama 1975, that is subject to the requirements or reliability standards of the North American Electric Reliability Co… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Electric providers subject to NERC reliability standards Archived excerpt — the text we read … political action committee, political party, or principal campaign committee, as defined in Section 17-5-2, Code of Alabama 1975, or any political organization as defined in 26 U.S.C. §527. (13) An electric provider as defined under Chapter 16 of Title 37, Code of Alabama 1975, that is subject to the requirements or reliability standards of the North American Electric Reliability Corporation. (b) This act shall not apply to any of the following information or data: (1) Protected health information under the privacy regulations of the federal Health Insurance Portab… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
HIPAA protected health information Archived excerpt — the text we read …e requirements or reliability standards of the North American Electric Reliability Corporation. (b) This act shall not apply to any of the following information or data: (1) Protected health information under the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996 and related regulations. (2) Patient-identifying information for the purposes of 42 C.F.R. Part 2, established pursuant to 42 U.S.C. § 290dd-2. (3) Identifiable private information for the purposes of 45 C.F.R. Part 46. … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Patient-identifying information under 42 C.F.R. Part 2 Archived excerpt — the text we read … data: (1) Protected health information under the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996 and related regulations. (2) Patient-identifying information for the purposes of 42 C.F.R. Part 2, established pursuant to 42 U.S.C. § 290dd-2. (3) Identifiable private information for the purposes of 45 C.F.R. Part 46. (4) Identifiable private information that is otherwise collected as part of human subjects research pursuant to the … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Identifiable private information under 45 C.F.R. Part 46 Archived excerpt — the text we read … Portability and Accountability Act of 1996 and related regulations. (2) Patient-identifying information for the purposes of 42 C.F.R. Part 2, established pursuant to 42 U.S.C. § 290dd-2. (3) Identifiable private information for the purposes of 45 C.F.R. Part 46. (4) Identifiable private information that is otherwise collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the International Council for Harmo… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Human subjects research information under ICH guidelines Archived excerpt — the text we read …2) Patient-identifying information for the purposes of 42 C.F.R. Part 2, established pursuant to 42 U.S.C. § 290dd-2. (3) Identifiable private information for the purposes of 45 C.F.R. Part 46. (4) Identifiable private information that is otherwise collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. (5) The protection of human subjects under 21 C.F.R. Parts 50 and 56, or personal data used or shared in research as defined in the federal Health Insurance Portability and Accountability Act of … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Protection of human subjects under 21 C.F.R. Parts 50 and 56 and HIPAA research data Archived excerpt — the text we read …of human subjects research pursuant to the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. (5) The protection of human subjects under 21 C.F.R. Parts 50 and 56, or personal data used or shared in research as defined in the federal Health Insurance Portability and Accountability Act of 1996 and 45 C.F.R. § 164.501, that is conducted in accordance with applicable law. (6) Information or documents created for the purposes of the federal Health Care Quality Improvement Act of 1986. (7) Patient safety work products for the purposes of the federal Patient Safety a… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Health Care Quality Improvement Act information Archived excerpt — the text we read … used or shared in research as defined in the federal Health Insurance Portability and Accountability Act of 1996 and 45 C.F.R. § 164.501, that is conducted in accordance with applicable law. (6) Information or documents created for the purposes of the federal Health Care Quality Improvement Act of 1986. (7) Patient safety work products for the purposes of the federal Patient Safety and Quality Improvement Act of 2005. (8) Information derived from any of the health care related information … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Patient safety work products Archived excerpt — the text we read …and 45 C.F.R. § 164.501, that is conducted in accordance with applicable law. (6) Information or documents created for the purposes of the federal Health Care Quality Improvement Act of 1986. (7) Patient safety work products for the purposes of the federal Patient Safety and Quality Improvement Act of 2005. (8) Information derived from any of the health care related information listed in this subsection which is deidentified in accordance with the requirements for deidentification pursuant to the pr… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
HIPAA-deidentified health care information Archived excerpt — the text we read …purposes of the federal Health Care Quality Improvement Act of 1986. (7) Patient safety work products for the purposes of the federal Patient Safety and Quality Improvement Act of 2005. (8) Information derived from any of the health care related information listed in this subsection which is deidentified in accordance with the requirements for deidentification pursuant to the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996. (9) Information derived from any of the health care related information listed in this subsection which is included in a limited data set as described in 45 C.F.R. § 164.5… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
HIPAA limited data sets Archived excerpt — the text we read …n accordance with the requirements for deidentification pursuant to the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996. (9) Information derived from any of the health care related information listed in this subsection which is included in a limited data set as described in 45 C.F.R. § 164.514(e), to the extent that the information is used, disclosed, and maintained in a manner specified in 45 C.F.R. § 164.514(e). (10) Information originating from and intermingled to be indistinguishable with or information treated in the same manner as information exempt under this subsection which is maintained by a cove… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Information intermingled with exempt HIPAA information Archived excerpt — the text we read … included in a limited data set as described in 45 C.F.R. § 164.514(e), to the extent that the information is used, disclosed, and maintained in a manner specified in 45 C.F.R. § 164.514(e). (10) Information originating from and intermingled to be indistinguishable with or information treated in the same manner as information exempt under this subsection which is maintained by a covered entity or business associate as defined in the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996 or a program or qualified service organization as specified in 42 U.S.C. § 290dd-2. (11) Information used for public health activities and purposes as authorized by the federal Health Insurance Portability and Accountability Act of 1996, community health activities, and populati… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Public health activities information Archived excerpt — the text we read …ined in the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996 or a program or qualified service organization as specified in 42 U.S.C. § 290dd-2. (11) Information used for public health activities and purposes as authorized by the federal Health Insurance Portability and Accountability Act of 1996, community health activities, and population health activities. (12) The collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, gener… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
FCRA-regulated data Archived excerpt — the text we read …public health activities and purposes as authorized by the federal Health Insurance Portability and Accountability Act of 1996, community health activities, and population health activities. (12) The collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the federal Fair Credit Reporting Act. (13) Personal data collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994. (14) Personal data regulated by the… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Driver's Privacy Protection Act data Archived excerpt — the text we read …ormation for use in a consumer report and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the federal Fair Credit Reporting Act. (13) Personal data collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994. (14) Personal data regulated by the federal Family Educational Rights and Privacy Act of 1974. (15) Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
FERPA-regulated data Archived excerpt — the text we read …ral Fair Credit Reporting Act. (13) Personal data collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994. (14) Personal data regulated by the federal Family Educational Rights and Privacy Act of 1974. (15) Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act of 1971. (16) Data processed or maintained by an individual applying to, employed … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Farm Credit Act data Archived excerpt — the text we read … disclosed in compliance with the federal Driver's Privacy Protection Act of 1994. (14) Personal data regulated by the federal Family Educational Rights and Privacy Act of 1974. (15) Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act of 1971. (16) Data processed or maintained by an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party to the extent that the data… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Employment data Archived excerpt — the text we read …egulated by the federal Family Educational Rights and Privacy Act of 1974. (15) Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act of 1971. (16) Data processed or maintained by an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party to the extent that the data is collected and used within the context of that role. (17) Data processed or maintained as the emergency contact information of an individual under this act and used for emergency contact purposes. (18) Data processed or maintained that is necessary… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Emergency contact information Archived excerpt — the text we read …to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party to the extent that the data is collected and used within the context of that role. (17) Data processed or maintained as the emergency contact information of an individual under this act and used for emergency contact purposes. (18) Data processed or maintained that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under this section and… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Benefits administration data Archived excerpt — the text we read …nd used within the context of that role. (17) Data processed or maintained as the emergency contact information of an individual under this act and used for emergency contact purposes. (18) Data processed or maintained that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under this section and is used for the purposes of administering the benefits. (19) Personal data collected, processed, sold, or disclosed in relation to price, route, or service, as these terms are used in the federal Airline Deregulation Act of 1978 by an air carrier subj… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Airline Deregulation Act data Archived excerpt — the text we read … to administer benefits for another individual relating to the individual who is the subject of the information under this section and is used for the purposes of administering the benefits. (19) Personal data collected, processed, sold, or disclosed in relation to price, route, or service, as these terms are used in the federal Airline Deregulation Act of 1978 by an air carrier subject to the act. (20) Data or information collected or processed to comply with or in accordance with state law. (21) Personal data collected or used pursuant to 21 U.S.C. § 830. (c) Contr… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Data or information collected or processed to comply with, or in accordance with, state law Archived excerpt — the text we read …ocessed, sold, or disclosed in relation to price, route, or service, as these terms are used in the federal Airline Deregulation Act of 1978 by an air carrier subject to the act. (20) Data or information collected or processed to comply with or in accordance with state law. (21) Personal data collected or used pursuant to 21 U.S.C. § 830. (c) Controllers and processors that comply with the verifiable parental consent requirements of the federal Chi… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Data collected under 21 U.S.C. § 830 Archived excerpt — the text we read …are used in the federal Airline Deregulation Act of 1978 by an air carrier subject to the act. (20) Data or information collected or processed to comply with or in accordance with state law. (21) Personal data collected or used pursuant to 21 U.S.C. § 830. (c) Controllers and processors that comply with the verifiable parental consent requirements of the federal Children's Online Privacy Protection Act of 1998 are compliant … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Evidentiary privilege (compliance would violate an Alabama evidentiary privilege) Archived excerpt — the text we read …compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party. (c) The obligations imposed on controllers or processors under this act may not apply when compliance by the controller or processor with this act would violate an evidentiary privilege under the laws of this state. Nothing in this act may be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Personal or household activities Archived excerpt — the text we read … (e) Nothing in this act may be construed to do either of the following: (1) Impose any obligation on a controller or processor that adversely affects the rights or freedoms of any person. (2) Apply to a person's processing of personal data during the person's personal or household activities. (f) Personal data processed by a controller pursuant to this section may be processed to the extent that the processing is both of the following: (1) Reasonably necessary and proportionate to the … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Privileged communications to a person covered by an evidentiary privilege Archived excerpt — the text we read …tions imposed on controllers or processors under this act may not apply when compliance by the controller or processor with this act would violate an evidentiary privilege under the laws of this state. Nothing in this act may be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication. (d)(1) If, at the time a controller or processor discloses personal data to a processor or third-party controller in accordance with this act, the controller or processor did not have actual know… Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source
Rights and freedoms of others Archived excerpt — the text we read … controller or processor from which the receiving processor or third-party controller receives the personal data. (e) Nothing in this act may be construed to do either of the following: (1) Impose any obligation on a controller or processor that adversely affects the rights or freedoms of any person. (2) Apply to a person's processing of personal data during the person's personal or household activities. (f) Personal data processed by a controller pursuant to this section may be processed to the … Archived from source — captured 2026-08-03 · snapshot 2ec42f5a Verify at the source

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source.

Timeline

The road to APDPA enforcement

This state currently has one dated milestone on the books.

Enforcement May 1, 2027

APDPA takes effect

Enforcement begins — obligations are live from this date.

Source: primary citation

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source. Reference only, not legal advice.

Status Signed Private right of action — Privacy-law tracker

When staying on top of the law isn't enough, DataGrail automates the work.

DSR automation and regulatory tracking — handled by the platform behind this reference.

How DataGrail helps

Back to the Regulations Hub Reference only — not legal advice. Published Sep 29, 2026