Law note · Alabama
Alabama Personal Data Protection Act (HB 351), Attorney General enforcement
cite Ala. HB 351, 2026 Regular Session, Sec. 11
stage IMMINENT in force in 245 days
effective 2027-05-01
reviewed 2026-08-27
Once in force, the Alabama Attorney General will have exclusive authority to enforce APDPA. Before any enforcement action, the Attorney General must issue a written notice of violation to the controller; if the controller corrects the violation within 45 days and provides a written statement confirming the cure and that no further violations will occur, no action may be initiated. An uncured violation is subject to a court-assessed civil penalty of not more than $15,000 per violation. The Act creates no private right of action.
What it asks of an app
- This duty does not yet bind. APDPA's effective date is May 1, 2027.
- Expect APDPA to be enforced exclusively by the Alabama Attorney General. It creates no private right of action.
- Cure a noticed violation within 45 days and provide a written statement confirming the cure to avoid a civil penalty of not more than $15,000 per violation; the Attorney General must give this 45-day cure notice before bringing any enforcement action.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: enrolled bill text, Alabama Legislative Information System (ALISON)