Data Breach Notification Statutes – Alabama
Last Updated: 02/28/2024
- Applicable Statute: Ala. Code. §§ 8-38-1 — 8-38-12
- Attorney General Notice Required : Yes – Must notify the Attorney General if more than 1,000 residents notified.
- Timing : As expeditiously as possible and without unreasonable delay, but in no case more than 45 days from discovery of the breach.
- Method: See website: https://www.alabamaag.gov/
- Content : Notice to the Attorney General must include:
- A synopsis of events surrounding the breach;
- The approximate number of affected state residents;
- Information and instructions on any services the covered entity is offering to affected residents, without charge, related to the breach;
- The contact information of the employee or agent from whom additional information may be obtained.
- Consumer Notice Requirements:
- Timing: Must be made as expeditiously as possible and without unreasonable delay, taking into account the time necessary to conduct an investigation, but no later than 45 days after discovery and determination breach is reasonably likely to cause substantial harm.
- Method: By written notice or by email to the individual at the email address held by the subject entity.
- Content: Notice must include, at a minimum:
- The date, estimated date, or estimated date range of the breach;
- A description of the personal information that was acquired by an unauthorized person as part of the breach;
- A general description of actions taken to restore the security and confidentiality of personal information involved in the breach;
- A general description of steps an affected individual can take to protect against identity theft; and Information that the individual can use to contact the subject entity about the breach.
- Consumer Reporting Agency Obligations: If more than 1,000 residents are notified, the entity must also notify without unreasonable delay all nationwide consumer reporting agencies of the timing, distribution, and content of the notice.