On April 8, 2026, Alabama’s legislature passed House Bill 351, the Alabama Personal Data Protection Act (the APDPA), which now goes to Alabama’s governor, Kay Ivey, for signature. If signed, the law will take effect May 1, 2027.
The APDPA has a very low threshold for applicability compared to other state privacy laws and includes some variation from the standard Virginia and Connecticut models. Companies, including larger nonprofits, should therefore evaluate application of the APDPA and prepare for it to come into effect.
In Depth
Who does the APDPA apply to?
The APDPA applies to a controller or processor that conducts business in Alabama or produces products or services that are targeted to Alabama residents and meets either of the following criteria: