What Businesses Need to Know About the Alabama Personal Data Protection Act
In April 2026, Alabama enacted the Alabama Personal Data Protection Act ( APDPA ), making it the 22nd U.S. state to adopt a broad consumer privacy law governing how organizations collect, use, and disclose personal data. While the APDPA reflects many elements common to other state privacy frameworks, it also stands out for several business‑friendly features, including broad exemptions, a permanent cure period, and narrower operational obligations than those imposed by some other state laws. T he APDPA is scheduled to take effect on May 1, 2027, and reflects the continued expansion of state-level privacy legislation across the United States. Given its close alignment to existing consumer privacy laws such as the Virginia Consumer Data Protection Act (VCDPA) that was enacted in 2021 , organizations with existing privacy compliance programs likely will not be required to make substantial adjustments to their compliance programs if the APDPA applies to them. We discuss the APDPA in more d...