Breach Notice Deadlines — Alabama: The 45-Day Rule, AG Triggers, and Vendor 10-Day Hand-Off

What this covers

Alabama’s breach-notification regime applies to any covered entity (business or government entity) that acquires or uses Alabama residents’ sensitive personally identifying information (SPII) in electronic form, and to any third-party agent that maintains SPII for a covered entity. A “breach of security” is an unauthorized acquisition of electronic data containing SPII. SPII generally means a person’s name together with specific identifiers (for example, non-truncated SSN; driver’s license or passport number; financial account number with any required access credential; medical or health insurance identifiers; or a username/email with password or security Q&A). Information that is encrypted, truncated, or otherwise rendered unusable is not SPII unless the encryption key or credential was also compromised. Government entities are subject to the notice rules (with special penalty handling described below).

When notification is required

After a prompt, good-faith investigation, notification is required if SPII was acquired (or is reasonably believed to have been acquired) by an unauthorized person and is reasonably likely to cause substantial harm to affected individuals. Alabama’s statute expressly lists factors entities may use to decide whether acquisition likely occurred (e.g., indications of possession, downloading, use like fraudulent accounts, or public disclosure).

Deadlines at a glance

How to count the clock

The 45-day outside limit starts when the covered entity determines a breach meeting the harm threshold has occurred (or when it receives notice from a breached third-party agent). Alabama also requires that notices be sent “as expeditiously as possible and without unreasonable delay,” which means you should not wait until day 45 if you can reasonably notify earlier. When a law-enforcement delay applies, the deadline clock is effectively paused until the written delay ends.

Content and method of individual notices

Individual notices must be written and sent to the person’s last known mailing address, or by email if that is the normal way you communicate with the individual or if the person has agreed to email notices. Telephone notice may be used in narrow circumstances. Alabama also prescribes what the notice should include, such as:

• The date of the notice, and the date or estimated date of the breach.
• A description of the SPII involved in general terms.
• A description of how the covered entity is addressing the breach.
• Advice for the individual on how to protect themselves (e.g., monitoring accounts, credit reports).
• Contact methods for the individual to obtain more information.

If direct notice is not feasible, substitute notice is permitted if: (i) the cost is excessive (including when cost exceeds $500,000 or is excessive relative to the entity’s resources), (ii) contact information is insufficient, or (iii) affected persons exceed 100,000. Substitute notice must include a conspicuous website posting for 30 days and notice in print and broadcast media in areas where affected persons reside (or an alternative method approved by the Attorney General).

What the Attorney General notice must include

If more than 1,000 Alabama residents require notice, the AG notice must be sent within the same timing window and must include: (1) the timing, distribution, and content of the consumer notices; (2) the number of Alabama residents affected; and (3) the name, address, and contact details for a person who can answer questions about the incident. Covered entities may provide supplemental or updated information later if details change.

Consumer reporting agency notifications

When you notify more than 1,000 individuals at a single time, Alabama requires notice to all CRAs that compile nationwide consumer files (as defined by the Fair Credit Reporting Act). This CRA notice should cover the timing, distribution, and content of the individual notices and must be delivered without unreasonable delay. There is no fixed number of days in the statute, so build this into your day-one workplan to avoid a foot-fault while racing to meet the 45-day consumer and AG clocks.

Third-party agents: the 10-day handoff

If a service provider or other third-party agent experiences a breach in systems it maintains for you, it must tell you “as expeditiously as possible and without unreasonable delay,” but in any case no later than 10 days after the agent determines a breach occurred or has reason to believe one occurred. After you receive the agent’s notice, your own 45-day window to notify individuals (and, if applicable, the AG and CRAs) applies. A third-party agent that fails to inform the covered entity can face fines under the statute.

Decision not to notify: mandatory documentation

If your investigation concludes that notice is not required (for example, because the information was encrypted and the key was not compromised, or because there is no reasonable likelihood of substantial harm), Alabama requires you to document that determination in writing and to keep the record for at least five years. Maintain contemporaneous notes describing the factors considered (possession, downloading, evidence of use, public disclosure) and the rationale.

Special situations and exemptions

Encryption and truncation

If SPII is encrypted, truncated, or otherwise rendered unusable, it is generally excluded from the definition of SPII—and thus typically does not trigger notice—unless the encryption key or credential was also breached. This is a practical safe harbor: strong cryptography and good key management reduce your chances of needing to notify.

Entities governed by other breach laws

Alabama exempts entities that are already subject to federal or state breach-notification regimes (for example, HIPAA or GLBA frameworks), provided the entity (i) maintains procedures under those regimes, (ii) provides notice to affected individuals under those regimes, and (iii) sends a copy of the consumer notice to the Alabama Attorney General when the number of notified individuals exceeds 1,000. In other words, if you follow HIPAA or GLBA, you generally meet Alabama’s requirements—but still copy the AG when the 1,000-resident threshold is met.

Government entities

State and local government entities must provide notices like private entities, but they are exempt from civil monetary penalties. The Attorney General may still seek relief to compel performance, stop bad-faith actions, or address mistaken interpretations of the law. The AG must also file an annual report to state leadership summarizing breaches by government entities and compliance status.

Enforcement and penalties

Alabama’s Attorney General has exclusive authority to enforce the notification provisions. Civil penalties for violations of the notification rules may not exceed $500,000 per breach. Separately, a covered entity that violates the notification provisions can be liable for up to $5,000 per day for each consecutive day it fails to take reasonable action to comply. The statute does not create a private right of action, and government entities are exempt from civil penalties (subject to the AG’s non-monetary relief powers described above).

Putting the deadlines into practice

• Day 0–5 (Discovery & Scoping): Launch the investigation. Identify what SPII was involved, which residents are affected, whether the data was acquired, and whether the incident is reasonably likely to cause substantial harm. If a third-party agent is involved, ensure it notifies you within 10 days.
• Day 5–20 (Decision & Drafting): If the harm threshold is met, begin drafting notices for residents and prepare AG and CRA packages (if thresholds are met). If you conclude no notice is required, create and save your written determination (retain for 5 years).
• Day 20–35 (Finalization): Validate mailing/email lists and substitute-notice triggers (>$500k cost, insufficient contact data, >100,000 affected). Coordinate timelines with any law-enforcement written delay.
• By Day 45 (Drop-dead date): Send resident notices (and AG notice if >1,000 residents). Send CRA notice “without unreasonable delay” whenever the >1,000-individual trigger at a single time is met.
• Afterward: Keep records of notices sent and, if you chose not to notify, your written no-notice determination. Consider disposal duties for records no longer needed and update security controls to address root causes.

Conclusion

In Alabama, your breach-notice program should be designed around three clocks: the 45-day outside limit for notifying residents (and the Attorney General when more than 1,000 residents are affected), the “without unreasonable delay” obligation that compels earlier delivery when feasible, and the 10-day handoff from third-party agents to data owners. Layer in CRA notification “without unreasonable delay” when your mailing to individuals hits the 1,000-person threshold at a single time, and maintain thorough written records if you reasonably conclude that notice is not required. If you already operate under HIPAA or GLBA breach rules, following those procedures will generally satisfy Alabama—just remember to copy the AG when you notify more than 1,000 people. Executing to these timelines not only keeps you compliant, it also reduces legal exposure under Alabama’s penalty framework and, more importantly, helps affected people protect themselves quickly.