Governance, risk & compliance

Alabama Personal Data Protection Act (PDPA) HB 351 (2026 Reg. Sess.), enrolled; effective 1 May 2027 (not yet in force)

The Alabama Personal Data Protection Act is HB 351 of the 2026 Regular Session, with an effective date of 1 May 2027, so it is not yet in force.

The enrolled text was read from the Alabama Legislature. It applies to businesses in Alabama or targeting Alabama residents that process the personal data of more than 25,000 consumers, or earn more than 25% of gross revenue from selling personal data.

Exemptions include government, higher education, financial institutions, HIPAA entities, businesses with fewer than 500 employees that do not sell personal data, and small nonprofits that do not sell personal data. These are exemptions, not a tier.

Consumers can confirm and access, correct, delete and copy their data and opt out of targeted advertising, sale and profiling in furtherance of solely automated significant decisions. Responses are due in 45 days (extendable by 45).

The enrolled text has no appeal process, no data protection assessment duty and no universal opt-out mandate. Controllers must keep reasonable security, limit collection, allow consent to be revoked as easily as given, give a privacy notice with an active contact address, and provide an opt-out link or contact details.

Sensitive data needs consent, and targeted advertising or sale to consumers aged 13 to 15 needs consent. Processors need a binding contract.

The Attorney General enforces alone: a notice of violation with a 45-day cure and no sunset, then up to $15,000 per violation. The Act number and the Governor’s signing date (reported as 17 April 2026 by a secondary source) were not read from an official source.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Alabama Personal Data Protection Act (PDPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Alabama Personal Data Protection Act (PDPA) compliance

Most of Alabama Personal Data Protection Act (PDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Alabama Personal Data Protection Act (PDPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Alabama Personal Data Protection Act (PDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Alabama Personal Data Protection Act (PDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.