EdLaw
Alabama Data Breach Notification Act of 2018
Alabama's general breach-notification statute (Act 2018-396, Code of Ala. 1975 §§8-38-1 to 8-38-12). It binds every covered entity that acquires or uses sensitive personally identifying information of Alabama residents — government entities, and so public school systems, included — and every third-party agent that maintains, stores, processes or accesses that information for one. Alabama has no student-privacy statute of its own (see the research note), and this is the one statute the Alabama alliance's SDPC Exhibit G names: "Service providers must comply with the Alabama Data Breach Act of 2018, Alabama Code Title 8, Chapter 38" (Exhibit G).
Applicability to EdTech
- An EdTech provider holding an Alabama district's data is a third-party agent: an entity "contracted to maintain, store, process, or is otherwise permitted to access sensitive personally identifying information in connection with providing services to a covered entity" (§8-38-2(7)).
- A third-party agent must tell the district of a breach "no later than 10 days following the determination of the breach of security or reason to believe the breach occurred", and must supply what the district needs for its own notices; the parties may contract for the agent to handle the notifications (§8-38-8).
- The district then has 45 days to notify affected individuals where the breach is reasonably likely to cause substantial harm (§8-38-5(b)), and must notify the Attorney General when more than 1,000 individuals are affected (§8-38-6(a)).
- The statute's own security duty reaches the provider directly: "Each covered entity and third-party agent shall implement and maintain reasonable security measures" (§8-38-3(a)), with the elements listed in §8-38-3(b) — including retaining service providers that are contractually required to maintain appropriate safeguards (§8-38-3(b)(4)); so does the disposal duty (§8-38-10).
- "Sensitive personally identifying information" is name plus an identifier — SSN or tax ID, government ID numbers, financial account credentials, medical or health-insurance information, or a username or email address with a password or security question for an online account (§8-38-2(6)). Student usernames and passwords are within it; encrypted data is not, unless the key is breached too (§8-38-2(6)b.2.).
- A third-party agent that fails to inform the covered entity is itself subject to the chapter's fines and penalties (§8-38-9(b)(4)).
Contents
| Document | Covers |
|---|---|
| DATA-BREACH-ACT.md | §§8-38-1 to 8-38-12 in full |
Enforcement
A violation of the notification provisions is an unlawful trade practice under the Alabama Deceptive Trade Practices Act, enforced exclusively by the Attorney General, with no private cause of action (§8-38-9(a)); a covered entity that violates them is liable for a civil penalty of up to $5,000 per day (§8-38-9(b)(1)). Government entities are exempt from civil penalties, but the Attorney General may sue officials to compel performance (§8-38-9(b)(6)).
Licence
The reproduced text is Code of Ala. 1975 §§8-38-1 to 8-38-12, enacted by the Alabama Legislature (Act 2018-396) and served on the Legislature's ALISON site. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)
The ALISON section pages carry only "© 2026" beneath the Legislature's address in their footer (the rendered pages, 2026-10-08); that notice cannot reach the statutory text, for the reason above, and the corpus takes none of the site's own matter.
Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Alabama Legislature endorses the corpus.
Related
- SDPC state terms — Alabama Exhibit G — the alliance agreement clause that points here
- Alabama student data governance (research note) — why this, and not a student-privacy statute, is Alabama's operative law
- Ala. Admin. Code r. 290-3-1-.02 and the ALSDE Data Use and Governance Policy — the State Board's student-records layer
- Kentucky — personal information security and Pennsylvania — breach notification — sibling state breach statutes