DPA Short Form Transfer Addendum - Alabama (Litigation-Ready)

DPA SHORT FORM TRANSFER ADDENDUM -- ALABAMA

Litigation-Ready Format -- Section Numbering

Addendum Effective Date: [__/__/____]

Reference Agreement: [________________________________] dated [__/__/____] (the "Agreement")

Transferor (Covered Entity): [________________________________] ("Transferor")

Transferee (Third-Party Agent / Processor): [________________________________] ("Transferee")

This Addendum supplements the Agreement and governs all transfers of Personal Data involving Alabama residents. Alabama does not currently have a comprehensive consumer privacy law; however, the Alabama Data Breach Notification Act of 2018 (Ala. Code 8-38-1 et seq.) imposes specific security, breach notification, and data disposal requirements. This Addendum incorporates those requirements and establishes privacy best practices for data transfers consistent with emerging national standards.

SECTION 1: DEFINITIONS

Section 1.1 "Sensitive Personally Identifying Information" has the meaning given in Ala. Code 8-38-2(6) and means an Alabama resident's first name or first initial and last name in combination with one or more of: (a) a non-truncated Social Security number or tax identification number; (b) a non-truncated driver's license number, state-issued identification card number, passport number, military identification number, or other unique identification number issued on a government document used to verify the identity of a specific individual; (c) a financial account number, including a bank account number, credit card number, or debit card number, in combination with any security code, access code, password, expiration date, or personal identification number (PIN) needed to access the financial account or to conduct a transaction that will credit or debit the financial account; (d) any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (e) an individual's health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual; (f) a user name or email address, in combination with a password or security question and answer that would permit access to an online account affiliated with the covered entity that is reasonably likely to contain or is used to obtain sensitive personally identifying information.

Section 1.2 "Covered Entity" has the meaning given in Ala. Code 8-38-2(2) and means a person, sole proprietorship, partnership, government entity, corporation, nonprofit, trust, estate, cooperative association, or other business entity that acquires or uses sensitive personally identifying information.

Section 1.3 "Third-Party Agent" has the meaning given in Ala. Code 8-38-2(7) and means an entity that has been contracted to maintain, store, process, or otherwise is permitted to access sensitive personally identifying information in connection with providing services to a covered entity.

Section 1.4 "Breach of Security" or "Data Breach" has the meaning given in Ala. Code 8-38-2(1) and means the unauthorized acquisition of data in electronic form containing sensitive personally identifying information. The statutory definition has specified exclusions, and § 8-38-2(6)(b) excludes information rendered unusable subject to its compromised-key or credential exception.

Section 1.5 "Personal Data" for purposes of this Addendum means any information relating to an identified or identifiable natural person who is an Alabama resident, including Sensitive Personally Identifying Information and any additional categories of data that constitute "personal data" or "personal information" under other Applicable Data Protection Laws.

Section 1.6 "Controller" and "Processor" -- Alabama law does not use these terms. The Parties adopt them for this Addendum: the Transferor is the "Controller" (Covered Entity) and the Transferee is the "Processor" (Third-Party Agent).

Section 1.7 "Processing" means any operation performed on Personal Data, including collection, use, storage, disclosure, analysis, modification, or destruction.

Section 1.8 "Subprocessor" means any third party engaged by the Transferee to Process Personal Data on behalf of the Transferor.

Section 1.9 "Applicable Data Protection Laws" means the Alabama Data Breach Notification Act, any other Alabama statutes relating to data privacy or security, and any federal or other state laws that apply to the Processing contemplated by this Addendum.

SECTION 2: SCOPE AND PURPOSE OF TRANSFER

Section 2.1 Regulatory Framework. Alabama's data protection framework is centered on the Alabama Data Breach Notification Act of 2018 (Acts 2018-396). Alabama does not have a comprehensive consumer privacy law. This Addendum addresses:

☐ Alabama Data Breach Notification Act (Ala. Code 8-38-1 et seq.)
☐ Common law privacy torts
☐ Other applicable federal/state laws: [________________________________]

Section 2.2 Transfer Relationship.

☐ Covered Entity to Third-Party Agent (Controller-to-Processor)
☐ Covered Entity to Covered Entity (Controller-to-Controller)
☐ Third-Party Agent to Sub-Agent (Processor-to-Sub-Processor)

Section 2.3 Purpose. Personal Data is Transferred solely for: [________________________________]

Section 2.4 Categories of Data Subjects.

☐ Alabama resident customers and prospective customers
☐ Alabama resident employees and applicants
☐ Alabama resident end users
☐ Alabama resident business contacts
☐ Alabama resident patients or health plan members (if applicable)
☐ Other: [________________________________]

Section 2.5 Categories of Personal Data.

☐ Names and identifiers
☐ Social Security numbers or tax IDs
☐ Driver's license, state ID, passport, or military ID numbers
☐ Financial account numbers with security codes/PINs
☐ Credit/debit card numbers with expiration dates
☐ Medical history, health conditions, treatment records
☐ Health insurance policy/subscriber numbers
☐ Username/email with passwords or security Q&A
☐ Online identifiers (IP, device IDs)
☐ Employment and HR data
☐ Commercial and transaction data
☐ Other: [________________________________]

Section 2.6 Duration. Agreement term plus [____] day wind-down.

SECTION 3: LEGAL BASIS FOR TRANSFER

Section 3.1 Domestic Basis.

☐ Performance of the Agreement (contractual necessity)
☐ Legitimate business interests
☐ Consent of the data subject
☐ Legal obligation
☐ Other: [________________________________]

Section 3.2 International Transfer (if applicable).

☐ EU-US Data Privacy Framework
☐ Standard Contractual Clauses (Module [____])
☐ UK Addendum / IDTA
☐ Not applicable

SECTION 4: DATA CATEGORIES AND SENSITIVITY CLASSIFICATION

Section 4.1 Alabama Sensitive Personally Identifying Information (Ala. Code 8-38-2(6)):

☐ Non-truncated SSN or tax ID number
☐ Non-truncated driver's license number
☐ State-issued ID card number
☐ Passport number
☐ Military identification number
☐ Other government document ID number
☐ Financial account number with security code/password/PIN
☐ Credit card number with expiration date and security code
☐ Debit card number with PIN
☐ Medical history or health condition information
☐ Mental health condition or treatment information
☐ Health insurance policy number or subscriber ID
☐ Health insurer unique identifier
☐ Username or email with password or security Q&A (for affiliated online accounts)

Section 4.2 Additional Personal Data:

☐ Full name ☐ Email address ☐ Phone number ☐ Physical address
☐ Date of birth ☐ IP address ☐ Device identifiers ☐ Purchase history
☐ Employment data ☐ Education records ☐ Internet activity data
☐ Geolocation data ☐ Biometric data ☐ Other: [________________________________]

Section 4.3 If any Section 4.1 categories are checked, the enhanced safeguards in Section 7.8 are mandatory.

SECTION 5: TRANSFEROR OBLIGATIONS

Section 5.1 Security Measures (Ala. Code 8-38-3). The Transferor, as a Covered Entity, shall implement and maintain reasonable security measures to protect Sensitive Personally Identifying Information against a breach of security. Such measures shall be appropriate to: (a) the sensitivity of the information; (b) the size, complexity, and capabilities of the entity; (c) the cost of available tools to improve security and reduce vulnerabilities; and (d) the entity's efforts to identify the most likely risks and the most serious threats to the information.

Section 5.2 Third-Party Agent Oversight. By entering into this Addendum, the Transferor fulfills its obligation to contractually require the Transferee (Third-Party Agent) to implement and maintain reasonable security measures (Ala. Code 8-38-3(c)).

Section 5.3 Lawful Collection. All Personal Data Transferred has been collected lawfully and in accordance with applicable notices and consents.

Section 5.4 Data Minimization. The Transfer is limited to Personal Data reasonably necessary for the stated purposes.

Section 5.5 Privacy Notice. The Transferor maintains a privacy notice describing its data collection and sharing practices, including the Transfer contemplated by this Addendum.

Section 5.6 Multi-State Compliance. Where the Transferor is subject to comprehensive privacy laws of other states (CCPA/CPRA, VCDPA, CPA, CTDPA, TDPSA, FDBR), the Transferor shall comply with those laws' requirements for vendor contracts and data transfers.

Section 5.7 Cooperation. The Transferor shall cooperate with the Transferee in fulfilling obligations under this Addendum.

SECTION 6: TRANSFEREE OBLIGATIONS

Section 6.1 Purpose Limitation. The Transferee shall Process Personal Data solely for the purposes specified in Section 2.3 and in accordance with the Transferor's documented instructions.

Section 6.2 Prohibitions. The Transferee shall not:

(a) Sell Personal Data;
(b) Share Personal Data for advertising purposes without authorization;
(c) Process for any purpose other than the specified purposes;
(d) Combine Personal Data with data from other sources without instruction;
(e) Disclose Personal Data to unauthorized third parties.

Section 6.3 Security Measures (Ala. Code 8-38-3(c)). The Transferee, as a Third-Party Agent, shall implement and maintain reasonable security measures to protect Sensitive Personally Identifying Information against a breach of security, considering the factors listed in Section 5.1.

Section 6.4 Confidentiality. All personnel with access to Personal Data shall be bound by confidentiality obligations.

Section 6.5 Breach Notification Obligations.

(a) 10-Day Third-Party Agent Notification (Ala. Code 8-38-8). If the Transferee experiences or discovers a breach of security, or has reason to believe a breach of security has occurred, the Transferee shall notify the Transferor as expeditiously as possible and without unreasonable delay, but no later than ten (10) days following the determination or reason to believe that a breach has occurred. This is a critical, accelerated timeline.

(b) The notification shall include all information required by the Transferor to fulfill its notification obligations under Ala. Code 8-38-5 and 8-38-6.

Section 6.6 Data Disposal (Ala. Code 8-38-10). The Transferee shall, when discarding, disposing, or otherwise rendering Sensitive Personally Identifying Information unusable or unreadable, take reasonable measures to do so, including by:

(a) Shredding;
(b) Erasing; or
(c) Otherwise modifying the information to make it unreadable or undecipherable through any means practicable, including by methods meeting or exceeding NIST SP 800-88 standards.

Section 6.7 Audit Cooperation. The Transferee shall cooperate with audits and assessments as described in Section 12.

Section 6.8 Consumer Support. Though Alabama lacks comprehensive consumer privacy rights, the Transferee shall cooperate with reasonable data subject requests as described in Section 8.

Section 6.9 Regulatory Notification. The Transferee shall promptly notify the Transferor if it can no longer meet its obligations under this Addendum or applicable law.

SECTION 7: TECHNICAL AND ORGANIZATIONAL MEASURES

Section 7.1 Reasonable Security Standard (Ala. Code 8-38-3). The Transferee shall implement and maintain reasonable security measures appropriate to the sensitivity of the information, considering the size, complexity, and capabilities of the entity, the cost of available tools, and the most likely risks and most serious threats.

Section 7.2 Encryption.

(a) All Sensitive Personally Identifying Information shall be encrypted in transit using TLS 1.2 or higher.
(b) All Sensitive Personally Identifying Information at rest shall be encrypted using AES-256 or equivalent. Assess whether encryption renders the information unusable under Ala. Code 8-38-2(6)(b)(2), including whether a key or credential was breached together with it.
(c) Encryption keys managed separately; rotated annually.

Section 7.3 Access Controls.

(a) Role-based access control (RBAC) limiting access on a need-to-know basis;
(b) Multi-factor authentication for administrative and remote access;
(c) Quarterly access reviews; prompt de-provisioning;
(d) Unique user credentials; no shared accounts.

Section 7.4 Pseudonymization. Where technically feasible, the Transferee shall pseudonymize or de-identify Personal Data. No re-identification attempts permitted.

Section 7.5 Network Security.

(a) Firewalls, IDS/IPS, and endpoint protection;
(b) Quarterly vulnerability assessments; annual penetration testing;
(c) Critical patches within [____] days;
(d) Secure SDLC practices.

Section 7.6 Logging and Monitoring.

(a) Access logging (identity, data, timestamp, action);
(b) Log retention of [____] months; tamper protection;
(c) Automated alerting for unauthorized access.

Section 7.7 Physical Security.

(a) Badge access, visitor logs, and surveillance at data centers;
(b) Media disposal under the selected NIST SP 800-88 method; assess the actual records and method against Ala. Code 8-38-10's reasonable-measures standard.

Section 7.8 Enhanced Measures for Sensitive Personally Identifying Information. Where the Transfer involves Ala. Code 8-38-2(6) data:

(a) Field-level encryption for all SPII elements (subject to the statutory definition and compromised-key or credential exception);
(b) Data masking/tokenization in non-production environments;
(c) Real-time access alerting for SPII access;
(d) Segregated storage for SPII where technically feasible;
(e) Enhanced disposal procedures per Ala. Code 8-38-10;
(f) Annual security risk assessment addressing SPII-specific threats.

Section 7.9 Encryption Assessment. The Parties shall record whether information was encrypted or otherwise rendered unusable and whether a key or credential was breached with it. Ala. Code 8-38-2(6)(b)(2) controls whether that information falls outside the statutory definition; encryption alone does not resolve every notice duty.

Section 7.10 Business Continuity. BC/DR plans with RTO of [____] hours and RPO of [____] hours covering SPII protection and recovery.

SECTION 8: DATA SUBJECT RIGHTS SUPPORT

Section 8.1 Alabama Framework. Alabama does not have a comprehensive consumer privacy law granting broad data subject rights (access, deletion, correction, portability, opt-out). However, the Transferee shall support the following best practices:

Section 8.2 Best Practice Consumer Support.

(a) Access Requests: The Transferee shall assist the Transferor in responding to reasonable requests from Alabama residents to confirm whether their Personal Data is being Processed. Response within [____] days.
(b) Deletion Requests: The Transferee shall delete Personal Data upon the Transferor's instruction. Response within [____] days.
(c) Correction Requests: The Transferee shall correct inaccurate Personal Data upon the Transferor's instruction. Response within [____] days.
(d) Data Portability: The Transferee shall provide Personal Data in a machine-readable format upon the Transferor's request.

Section 8.3 Multi-State Consumer Rights. Where the Transferor is subject to comprehensive privacy laws of other states that grant rights to Alabama residents (e.g., a California business with Alabama customers), the Transferee shall assist with fulfilling those rights. Response timelines shall follow the applicable state law:

Section 8.4 Future Alabama Privacy Law. If Alabama enacts a comprehensive consumer privacy law, the Parties shall amend this Addendum to incorporate the new requirements within [____] days of the law's effective date.

SECTION 9: SUBPROCESSOR MANAGEMENT

Section 9.1 Third-Party Agent Obligation. If the Transferee further discloses Sensitive Personally Identifying Information to a Subprocessor, the Transferee is responsible for ensuring the Subprocessor implements reasonable security measures and complies with breach notification requirements, including the 10-day notification to the Transferor.

Section 9.2 Authorization.

☐ Specific prior written authorization for each Subprocessor
☐ General authorization with [____] days' prior notice and objection right

Section 9.3 Objection. The Transferor may object within [____] days on reasonable grounds. If unresolved within [____] days, the Transferor may terminate affected Processing.

Section 9.4 Flow-Down Requirements:

(a) Reasonable security measures (Ala. Code 8-38-3);
(b) 10-day breach notification to Transferee, who in turn notifies Transferor (Ala. Code 8-38-8);
(c) Confidentiality obligations;
(d) Purpose limitation;
(e) Audit cooperation;
(f) Data disposal per Ala. Code 8-38-10;
(g) Return/deletion upon termination.

Section 9.5 Liability. The Transferee remains fully liable for Subprocessor performance.

Section 9.6 Current List. ☐ Exhibit C ☐ URL: [________________________________]

SECTION 10: DATA BREACH NOTIFICATION

Section 10.1 Unique Alabama Timelines -- Critical Compliance Points.

The Alabama Data Breach Notification Act imposes the following specific deadlines:

(a) Third-Party Agent to Covered Entity: 10 DAYS (Ala. Code 8-38-8). The Transferee shall notify the Transferor no later than ten (10) days following the Transferee's determination that a breach has occurred or its reason to believe a breach has occurred. This is among the shortest third-party notification deadlines in the United States.

(b) Covered Entity to Individuals: 45 DAYS (Ala. Code 8-38-5). The Transferor shall notify affected individuals within forty-five (45) days of its determination that a breach has occurred and is reasonably likely to cause substantial harm.

(c) Covered Entity to Attorney General: 45 DAYS (Ala. Code 8-38-6). If the breach affects more than 1,000 Alabama residents, the Transferor shall notify the Alabama Attorney General within 45 days.

Section 10.2 Substantial Harm Standard. Under Ala. Code 8-38-5(a), notification is required only if the breach "is reasonably likely to cause substantial harm to the individuals to whom the information relates." The assessment of substantial harm shall consider: (a) the nature and sensitivity of the SPII involved; (b) the likelihood the information has been or will be accessed or used for unauthorized purposes; (c) the actions taken to prevent unauthorized use; and (d) any other factors the Transferor reasonably considers relevant.

Section 10.3 Notification to Transferor -- Content. The Transferee's 10-day notification shall include:

(a) Nature of the breach and description of what occurred;
(b) Categories of SPII involved;
(c) Approximate date of the breach;
(d) Date of discovery;
(e) Number or estimated number of Alabama residents affected;
(f) Description of mitigation measures taken or planned;
(g) Whether law enforcement has been notified;
(h) Contact information for the Transferee's incident response team.

Section 10.4 Content of Individual Notice (Ala. Code 8-38-5(d)). The Transferor's notification to affected individuals shall include:

(a) Date, estimated date, or estimated date range of the breach;
(b) Description of SPII acquired as part of the breach;
(c) A general description of the covered entity's actions regarding the breach;
(d) General advice for the individual to remain vigilant;
(e) Contact information for the covered entity.

Section 10.5 Method of Notice (Ala. Code 8-38-5(d)-(e)). Direct notice is written mail or email to the address in the covered entity's records. Substitute notice is available when direct notice is infeasible because its cost is excessive relative to the entity's resources or exceeds $500,000, contact information is insufficient, or the affected individuals exceed 100,000. The statutory substitute method includes website notice, if the entity has a site, and print and broadcast media notice; an alternative requires Attorney General approval.

Section 10.6 Encryption Assessment. The Transferee shall document encryption status, key and credential exposure, and whether the method rendered information unusable under Ala. Code 8-38-2(6)(b)(2). The covered entity shall separately assess acquisition and substantial harm under Ala. Code 8-38-4 and 8-38-5.

Section 10.7 Law Enforcement Delay (Ala. Code 8-38-5(c)). A federal or state law enforcement agency may request a delay in writing if notice would interfere with a criminal investigation or national security. The agency's written request sets the period; a later written request may revoke or extend it. Calendar notice against the agency's direction and the applicable statutory clock.

Section 10.8 Supplemental Updates. Written updates every [____] hours until investigation is complete.

Section 10.9 Penalties (Ala. Code 8-38-9). The Attorney General has exclusive authority to seek the chapter's civil penalties. Distinct statutory routes include:

(a) Up to $5,000 per consecutive day that a covered entity fails to take reasonable action to comply with notification requirements under § 8-38-9(b)(1); and
(b) Civil penalties under § 8-19-11 for a knowing notice violation, capped at $500,000 per breach under § 8-38-9(a)(2). Do not treat that cap as a cap on the separate daily route.

Section 10.10 No Independent Notification. The Transferee shall not notify individuals or regulators independently without the Transferor's written consent, except as required by law.

SECTION 11: DATA RETENTION AND DELETION

Section 11.1 Retention Limitation. Retain only as long as reasonably necessary; not longer than Agreement term plus [____] days.

Section 11.2 Alabama Data Disposal (Ala. Code 8-38-10). When discarding SPII, the Transferee shall take reasonable measures to make it unreadable or undecipherable, including by shredding, erasing, or otherwise modifying the information. Electronic disposal shall meet or exceed NIST SP 800-88 standards.

Section 11.3 Return or Deletion. Upon termination, written request, or purpose completion:

☐ Return in structured, machine-readable format within [____] days
☐ Securely delete within [____] days using Ala. Code 8-38-10 compliant methods

Section 11.4 Deletion Certification. Written certification within [____] days specifying:

(a) Date of deletion;
(b) Categories of data deleted;
(c) Method of destruction (specifying compliance with Ala. Code 8-38-10);
(d) Confirmation that all copies, including backups, have been addressed;
(e) Name and title of certifying officer.

Section 11.5 Backup Deletion. Within [____] months when technically feasible; isolated and protected in interim; 8-38-10 disposal methods applied when technically feasible.

Section 11.6 Legal Hold. Permitted if required by law; Transferor notified; minimum necessary; protections continue.

SECTION 12: AUDIT RIGHTS

Section 12.1 Reasonable Security Verification. The Transferor retains the right to verify that the Transferee maintains reasonable security measures as required by Ala. Code 8-38-3.

Section 12.2 Evidence-Based Audit. The Transferee shall make available upon request:

(a) Current SOC 2 Type II report;
(b) ISO 27001 certification;
(c) Penetration test executive summary;
(d) Security questionnaire (SIG, CAIQ, or equivalent);
(e) Risk assessment documentation;
(f) Employee security training records;
(g) Data disposal certifications per Ala. Code 8-38-10.

Section 12.3 On-Site Audit. If evidence-based materials are insufficient:

(a) Frequency: [____] per year (additional if breach occurs);
(b) Notice: [____] business days;
(c) Scope: Limited to Transferor's Personal Data Processing;
(d) Confidentiality: Auditor bound by NDA;
(e) Costs: Transferor bears costs unless material non-compliance found.

Section 12.4 AG Cooperation. The Transferee shall cooperate with investigations by the Alabama Attorney General.

Section 12.5 Remediation. Non-compliance remediated within [____] days with evidence provided.

SECTION 13: CROSS-BORDER AND INTERSTATE TRANSFER

Section 13.1 Interstate. The Alabama Data Breach Notification Act applies to any covered entity that acquires or uses SPII of Alabama residents, regardless of the entity's location.

Section 13.2 Multi-State Processing. Where the Transferee Processes Personal Data of residents of multiple states, it shall comply with the breach notification and security requirements of each applicable state, including the state-specific timelines detailed below:

Section 13.3 International. Transfer mechanisms per Section 3.2.

Section 13.4 Data Localization.

☐ US only ☐ US and EEA/UK ☐ Specific: [________________________________] ☐ No restriction

Section 13.5 Change Notice. [____] days prior to relocation.

SECTION 14: LIABILITY AND INDEMNIFICATION

Section 14.1 Mutual Indemnification. Each Party indemnifies the other for claims arising from its breach of this Addendum.

Section 14.2 Transferee Special Indemnification.

(a) Alabama AG enforcement penalties (up to $5,000/day for non-compliance, $500,000 per breach);
(b) Consumer notification costs, credit monitoring, and identity protection arising from Transferee's Data Breach;
(c) Third-party claims (Alabama recognizes common law claims for negligence, wantonness, and invasion of privacy);
(d) Costs arising from the Transferee's failure to provide 10-day notification under Ala. Code 8-38-8;
(e) Data disposal non-compliance penalties under Ala. Code 8-38-10;
(f) Investigation and remediation costs.

Section 14.3 Enforcement Framework. The Alabama Data Breach Notification Act is enforced by the Alabama Attorney General (Ala. Code 8-38-9). The AG may bring an action for damages and injunctive relief. Additionally, Alabama common law provides potential causes of action for negligence, breach of fiduciary duty, and invasion of privacy.

Section 14.4 Private Claims. Under Ala. Code § 8-38-9(a)(1), a violation of this chapter does not establish a private cause of action under § 8-19-10. The chapter leaves independently available common-law and statutory rights unaffected; any such claim requires its own basis.

Section 14.5 Limitation. Agreement liability cap applies except for willful misconduct, unauthorized disclosure, failure to provide 10-day breach notice, and disposal violations.

SECTION 15: TERM AND TERMINATION

Section 15.1 Term. Coterminous with the Agreement.

Section 15.2 Breach Termination. [____] day cure period; immediate if incurable.

Section 15.3 Regulatory Change. If Alabama enacts comprehensive privacy legislation or materially amends the Data Breach Notification Act, the Parties shall negotiate amendments within [____] days.

Section 15.4 Survival. Sections 1, 6.1-6.6, 7, 8, 10, 11, 12, 14 survive.

SECTION 16: ALABAMA-SPECIFIC COMPLIANCE PROVISIONS

Section 16.1 Key Distinguishing Features of Alabama Law.

(a) Third-Party Agent Notice: A qualifying agent must notify the covered entity as expeditiously as possible and without unreasonable delay, no later than 10 days after determining that a breach occurred or having reason to believe it occurred (§ 8-38-8).
(b) Individual Notice: When § 8-38-5(a)'s acquisition and substantial-harm conditions are met, notice is due as expeditiously as possible and without unreasonable delay, within 45 days after the covered entity receives agent notice or makes its own qualifying determination, subject to subsection (c)'s written law-enforcement delay.
(c) Encryption Assessment: Section 8-38-2(6)(b)(2) excludes information rendered unusable unless the covered entity knows or has reason to know that a key or credential was breached with it. Document that assessment rather than assuming a blanket safe harbor.
(d) Notice Penalties: Section 8-38-9 contains a daily covered-entity route and a distinct capped knowing-violation route.

Section 16.2 Security Assessment. Ala. Code 8-38-3(c) assesses a covered entity's reasonable security measures as a whole, with emphasis on multiple or systemic failures and the entity's size, data and activities, and implementation costs relative to resources. This provision does not grant an automatic compliance safe harbor.

Section 16.3 Other Law. The parties shall separately assess any constitutional, sector-specific, or other legal requirements applicable to their actual activities and data. This Addendum does not declare a private constitutional cause of action.

Section 16.4 Alabama Deceptive Trade Practices. The Alabama Deceptive Trade Practices Act (Ala. Code 8-19-1 et seq.) may apply to misleading data handling practices. The Transferee shall not engage in data practices that could constitute deceptive or unconscionable acts.

Section 16.5 Healthcare Data. Alabama law specifically includes medical history, mental/physical health conditions, and health insurance information in the SPII definition. If the Transfer involves healthcare data, the Parties shall also evaluate HIPAA applicability and, if required, execute a Business Associate Agreement.

Section 16.6 Multi-State Compliance. Where Personal Data of residents of states with comprehensive privacy laws is included, the Transferee shall comply with applicable processor/service provider obligations in those jurisdictions.

SECTION 17: EXECUTION

TRANSFEROR (COVERED ENTITY):

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Organization: [________________________________]
Date: [__/__/____]

TRANSFEREE (THIRD-PARTY AGENT / PROCESSOR):

Signature: [________________________________]
Printed Name: [________________________________]
Title: [________________________________]
Organization: [________________________________]
Date: [__/__/____]

EXHIBIT A: DATA TRANSFER IMPACT ASSESSMENT

Assessment Date: [__/__/____] | Assessor: [________________________________]

Overall: ☐ Low ☐ Medium ☐ High ☐ Unacceptable

EXHIBIT B: TECHNICAL MEASURES CHECKLIST

EXHIBIT C: SUBPROCESSOR LIST AND DATA INVENTORY

Subprocessor List:

Data Inventory:

SOURCES AND REFERENCES

• Alabama Data Breach Notification Act (Ala. Code 8-38-1 et seq.) -- Full Text
• Alabama Attorney General -- Data Breach Notification -- Filing Requirements
• Davis Wright Tremaine -- Alabama Summary -- State Breach Law Overview
• Perkins Coie -- Alabama Breach Chart -- Notification Requirements
• Ala. Code 8-38-5 (Individual Notice) -- 45-Day Timeline
• Ala. Code 8-38-8 (Third-Party Agent Notice to Covered Entity) -- 10-Day Timeline
• Ala. Code 8-38-10 (Disposal of Records) -- Disposal Standards