How long does an Alabama business have to notify customers after a data breach?

Alabama gives a business up to 45 days to notify affected individuals after it determines a data breach has occurred, under the Alabama Data Breach Notification Act of 2018. The law sets the notification duty; it does not require a business to carry cyber insurance. But meeting that 45-day clock - notification, investigation, credit monitoring - is exactly what cyber coverage funds.

What does the statute actually require?

Code of Alabama Sec. 8-38-5, the Data Breach Notification Act of 2018, requires notice within 45 days of a covered entity's determination that a breach occurred, or within 45 days of the entity receiving notice from a third-party agent that a breach happened. The clock starts at determination, not at the moment the breach itself occurred - which matters, because investigation and confirmation can take real time before the 45 days even begins.

Does business size change the requirement?

No. There is no small-business exemption; the notification duty applies regardless of the size of the business or the number of individuals affected.

What triggers additional notification for larger breaches?

Where more than 1,000 individuals must be notified, the law requires additional written notice, including notice to the Alabama Attorney General within the same 45-day window. That threshold turns a routine breach response into one with a direct regulatory-notification obligation on top of notifying the affected individuals themselves.

What does the law require versus what it does not?

The Alabama Data Breach Notification Act mandates notification. It does not mandate that a business carry cyber or breach-response insurance - there is no such purchase requirement in state law. What the 45-day response actually costs is forensics to determine what happened, the notification process itself, and often credit monitoring for affected individuals, and that is the kind of cost a breach-response policy is built to fund.

For example, an Alabama clinic discovers a breach affecting 1,500 patients. The 45-day clock starts at the point the clinic determines a breach occurred, the 1,000-person threshold triggers the additional Attorney General notice, and the clinic bears the forensics and notification costs - the work a breach-response policy is built to fund.

See Alabama cyber liability insurance for how that coverage works, and whether Alabama requires commercial crime insurance for a related coverage question. A coverage review can confirm whether cyber coverage fits a specific business's data exposure.