The APDPA applies to persons conducting business in Alabama or producing products or services targeted to Alabama residents that meet either threshold:
-
Control or process personal data of more than 25,000 consumers, excluding data controlled or processed solely to complete a payment transaction.
-
Derive more than 25% of gross revenue from selling personal data, regardless of the number of consumers whose data they control or process.
These are alternative tests, and the consumer-volume threshold has no separate minimum dollar-revenue requirement. However, exemptions must also be considered.
A business with fewer than 500 employees is exempt if it does not sell personal data. Qualifying nonprofit entities with fewer than 100 employees are also exempt if they do not sell personal data.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Privacy Compliance Library.
These FAQs provide general information and operational commentary. They are not legal advice. Applicability and compliance obligations depend on an organization’s activities, data practices, exemptions, and circumstances. It is intended as a starting point for understanding the issues discussed and should not be relied on as a substitute for advice from qualified legal counsel.
These materials were obtained directly from the Federal Government public website and are posted here for your review and reference only. No Claim to Original U.S. Government Works. This may not be the most recent version. The U.S. Government may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.