Overview
The Alabama Data Breach Notification Act of 2018 (Chapter 38, §§ 8-38-1 to 8-38-12) is Alabama's data security and breach notification law that establishes requirements for organizations that acquire, use, maintain, or process sensitive personally identifying information. The Act requires covered entities and third-party agents to implement and maintain reasonable security measures to protect personal information from unauthorized access, acquisition, disclosure, or misuse. It also establishes procedures for investigating security breaches and mandates notification to affected individuals, the Alabama Attorney General, and, in certain cases, consumer reporting agencies when qualifying data breaches occur. In addition, the law requires the secure disposal of records containing sensitive personal information and provides enforcement mechanisms and penalties for non-compliance. The Act is designed to protect Alabama residents from identity theft, fraud, and other harms resulting from data breaches and inadequate information security practices.