Signed into law by Governor Kay Ivey on April 16, the Alabama Personal Data Protection Act (APDPA) will take effect on May 1, 2027, and establishes a broad framework governing the collection, use and sale of personal data. The law places Alabama alongside 20 other states that have adopted similar statutes and increasing pressure on companies to harmonize compliance programs nationwide.

The APDPA applies to businesses operating in Alabama or targeting its residents that either process the personal data of more than 25,000 consumers or derive more than 25% of revenue from the sale of personal data. According to an analysis of the statute by the Fisher Phillips law firm, those thresholds are comparatively low, meaning the law may reach a broader set of entities than similar statutes in other states.

At the same time, Alabama diverges from its peers by including extensive exemptions. Small businesses with fewer than 500 employees—provided they do not sell personal data—are carved out, as are nonprofits under 100 employees, higher education institutions, and certain regulated sectors such as financial institutions and HIPAA-covered entities.

Like most state privacy laws, the APDPA excludes employment-related data from coverage—aligning with states such as Virginia and Colorado, but diverging from California’s broader definition of “consumer,” which includes employees and job applicants.

For covered entities, compliance hinges on the distinction between “controllers” and “processors,” a model borrowed from other state laws and the EU’s GDPR. Controllers—those determining the purposes and means of data processing—bear the primary compliance burden.

Controllers must enable and respond to a suite of consumer rights, including access, correction, deletion and data portability, as well as opt-outs for targeted advertising, data sales and certain profiling activities. Businesses must respond to authenticated consumer requests within 45 days and provide at least one free response annually.

The law also imposes baseline governance requirements, including data minimization, purpose limitation, and the implementation of “reasonable” administrative, technical and physical security safeguards. Controllers must also publish compliant privacy notices and obtain consent before processing sensitive data.

However, Alabama stops short of adopting some of the more stringent features seen elsewhere. Unlike laws in California and Colorado, the APDPA does not mandate data protection impact assessments or require recognition of universal opt-out signals.

One area where Alabama aligns with a growing cohort of states is its broad definition of “sale.” The APDPA includes not only monetary exchanges but also transfers involving “other valuable consideration” that materially benefits the controller.

Read more: House GOP Rushing to Advance Federal Privacy Law Before Midterms

The law invests enforcement authority exclusively with the Alabama attorney general, providing no private right of action. Businesses benefit from a 45-day cure period following notice of violation, but failure to remediate can result in penalties of up to $15,000 per violation.

The Fisher Phillips analysis outlines several immediate steps for businesses ahead of the 2027 effective date. These include conducting data mapping exercises, reviewing and updating privacy notices, implementing systems to handle consumer rights requests, and assessing relationships with third-party data processors.

Companies are also advised to evaluate data practices involving minors and align Alabama compliance efforts with existing programs developed for other state regimes—an increasingly critical strategy as organizations contend with overlapping and sometimes inconsistent requirements.

In structure, the APDPA closely tracks the now-standard U.S. state privacy framework, emphasizing consumer rights, controller obligations and attorney general enforcement. But its broader exemptions and lighter compliance requirements in certain areas underscore the continued divergence among state laws.

For businesses, Alabama’s entry into the privacy landscape reinforces the need for scalable, multi-jurisdictional compliance architectures rather than state-by-state fixes. As more states adopt similar but not identical rules, operational complexity will continue to rise in the absence of federal preemption.

A “joyful” 10-year-old Alabama girl was found dead soon after being reported missing — with another juvenile charged with her murder.

Katheryn Bigbee, 10, was reported missing just before 11 p.m. Friday, when police were called to an undisclosed address in Calhoun County, AL.com reported.

“Officers responded immediately to the residence,” Piedmont Police Chief Nathan Johnson said in a statement. “They tragically discovered a deceased juvenile inside the home.”

It remains unclear where the house was, or whether it was the young girl’s family home — but another juvenile was soon taken into custody and hit with murder charges.

Their identity and connection to Bigbee have not been disclosed due to their age.

Bigbee’s cause of death also remains unclear, with police saying the investigation was still ongoing.

“Our family has been torn to pieces, and we have lost the most amazing, sweetest little girl,” relative Blake Trammel wrote on Facebook.

“She was a light in any room she walked into. I cannot express the pain, guilt, and emptiness that has come from all of this. We don’t have answers, only more questions,” he added.

The girl’s school also recalled her as a beloved member of its community.

“Our entire Piedmont Elementary School family is grieving as we remember a sweet little girl who brought smiles, kindness, and a bright light to our halls each day,” the school said in a statement.

“Katheryn had a joyful, spunky personality that made her truly special,” the school said. “She was an enthusiastic reader and will be remembered for the happiness she shared so freely.”

“She will always be a part of our school family, and her memory will live on in the hearts of her classmates, teachers, and all who knew and loved her.”