ShareAndGoShareAndGo

Data breach notification

Alabama data breach notification law

Alabama's rules sit in the Alabama Data Breach Notification Act of 2018, Ala. Code §§ 8-38-1 to 8-38-12, with notice to individuals in § 8-38-5 and notice to the Attorney General in § 8-38-6.

What Alabama treats as sensitive information

The Act uses the phrase "sensitive personally identifying information." It starts with an Alabama resident's first name or first initial and last name, combined with at least one listed item about that same resident.

  • A non-truncated Social Security number or tax identification number.
  • A non-truncated driver's license, state ID, passport, military ID or other government ID number.
  • A financial account or card number together with any code, password, expiry date or PIN needed to access it.
  • Medical history, condition, treatment or diagnosis, and a health insurance policy or subscriber number.
  • A user name or email address with a password or security question and answer for an online account affiliated with the covered entity that is reasonably likely to contain such information.

Information that is truncated, encrypted, secured or otherwise rendered unusable falls outside the definition, unless the key or credential was breached too.

Who must be told, and how fast

PointAlabama rule
IndividualsAs expeditiously as possible and without unreasonable delay, and within 45 days
When the 45 days startFrom the entity's own determination that a breach occurred, or from receipt of notice from a third-party agent
Attorney GeneralWritten notice when more than 1,000 individuals must be notified
Attorney General timingAs expeditiously as possible and without unreasonable delay
Harm testNotice is owed where the breach is reasonably likely to cause substantial harm
Encrypted dataExcluded unless the key or credential was also breached

Section 8-38-5 says notice to individuals "shall be made as expeditiously as possible and without unreasonable delay." The same section sets the 45-day outer limit, counted from the covered entity's determination that a breach has occurred or from its receipt of notice from a third-party agent.

The substantial harm threshold

Alabama does not ask for a letter after every incident. Notice is owed when information was acquired, or is reasonably believed to have been acquired, and that acquisition is reasonably likely to cause substantial harm to the people it relates to. That makes the facts gathered in the first days after discovery important, because they shape whether the threshold is met at all.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

The watermark is a per-room setting and is on by default, so a page viewed in the room names the reader and the day it was opened. Recipients confirm their email with a six-digit code and need no account, so every entry in the log points to a confirmed address. When a team needs to work out whose records a particular reader opened, the chained log exports as CSV and can be sorted in a spreadsheet by person, file and date.

Alabama questions

Does Alabama set a fixed deadline?
Yes. Notice to individuals must be given within 45 days of the covered entity's determination that a breach occurred, or of its receipt of notice from a third-party agent, and as expeditiously as possible within that window.
When does the Attorney General hear about it?
When the number of individuals the entity must notify exceeds 1,000, the entity gives written notice to the Attorney General as expeditiously as possible and without unreasonable delay.
Are online account logins covered?
Yes. A user name or email address combined with a password or security question and answer for an online account affiliated with the covered entity is on the list, where that account is reasonably likely to contain or be used to obtain sensitive personally identifying information.
Do truncated numbers count?
The Social Security, tax ID and government ID items are written as non-truncated numbers, and truncated information is outside the definition.

Review date

Checked against Alabama's published law on November 2, 2026. This is general information, not legal advice.

Keep reading

Breach notification laws by state

All 54 jurisdictions in one list.

ShareAndGo vs DataRooms.com

How two data rooms handle access records.

ShareAndGo

The ShareAndGo home page.