Data Breach Notice to Residents and State Authorities in Alabama

At a glance

Requirements one by one

Trigger and investigation

Ala. Code § 8-38-2(1), (6) defines a breach as unauthorized acquisition of electronic data containing sensitive personally identifying information. It covers an Alabama resident's name paired with specified IDs, financial-account access data, medical or insurance information, or qualifying online-account credentials. Encrypted data remain in scope if the entity knows or has reason to know the key or credential was breached with the data. Good-faith employee acquisition for business purposes is excluded unless unrelated or further unauthorized use occurs.

Under § 8-38-4, a covered entity must promptly investigate a possible breach, including what information and people were involved, whether acquisition occurred, and whether substantial harm is reasonably likely. Section 8-38-5(a) requires individual notice when unauthorized acquisition was or is reasonably believed to have occurred and is reasonably likely to cause substantial harm. A no-notice determination must be written and retained at least five years under subsection (f).

Notice recipients and clocks

The entity sends required individual notice as expeditiously as possible without unreasonable delay, ordinarily within 45 days after it receives notice of a breach from a third-party agent or determines that a breach occurred and is reasonably likely to cause substantial harm. See § 8-38-5(b). An agent has its own expeditious, no-unreasonable-delay duty to tell the entity, no later than 10 days after determining or having reason to believe a breach occurred under § 8-38-8.

If more than 1,000 individuals must be notified, § 8-38-6 requires a written Attorney General report on the same 45-day trigger clock. It includes an incident synopsis, approximate Alabama affected count, free services if any, and a contact person. Section 8-38-7 separately requires notice without unreasonable delay to all nationwide consumer reporting agencies if more than 1,000 people require notice at one time, stating the timing, distribution, and content of individual notices.

Individual delivery and substitute notice

Section 8-38-5(d) permits mail or email. The message must state the breach date or range, acquired information, restoration efforts, protective steps, and a covered-entity contact. If direct notice is infeasible because of excessive cost relative to resources, cost over $500,000, more than 100,000 affected people, or insufficient contact information, subsection (e) permits substitute notice. It calls for a website post for 30 days if the entity has a site, and print and broadcast media in major urban and rural areas where affected people live; the Attorney General may approve an alternative substitute form.

What trips people up

Police delay needs a written request. Under § 8-38-5(c), a federal or state law-enforcement agency may delay individual notice if notice would interfere with a criminal investigation or national security. Its written request sets the period; a later written request can revoke or extend it.

Regulated-entity exemptions retain an AG copy duty. Section 8-38-11 exempts entities following qualifying federal breach-notice procedures, and § 8-38-12 covers sufficiently thorough state procedures. Each requires individual notice and a timely Attorney General copy when more than 1,000 people were notified.

Common questions

Does suspected exposure alone require notice?

Section 8-38-4 requires an investigation when a breach has or may have occurred. Section 8-38-5(a) requires notice only when acquisition was or is reasonably believed to have occurred and substantial harm is reasonably likely.

Can a contractor handle the notices?

Section 8-38-8 permits a contractual agreement for a third-party agent to handle chapter notices. The agent still supplies the covered entity information needed for compliance.

Statutes and sources

• Ala. Code § 8-38-2 — definitions and covered information.
• Ala. Code § 8-38-4 — investigation.
• Ala. Code § 8-38-5 — individual notice and methods.
• Ala. Code § 8-38-6 — Attorney General notice.
• Ala. Code § 8-38-7 — consumer reporting agencies.
• Ala. Code § 8-38-8 — third-party agents.
• Ala. Code § 8-38-11 — federal-regulation exemption.
• Ala. Code § 8-38-12 — state-regulation exemption.

Current official text accessed October 14, 2026.