How long does an Alabama business have to notify customers after a data breach?

45 days. Alabama’s Data Breach Notification Act (Code of Alabama Sec. 8-38-5) requires a covered entity to notify affected individuals within 45 days of determining a breach of sensitive personally identifying information occurred, or within 45 days of receiving notice from a third-party agent that a breach happened. There is no exemption for small businesses — the duty applies regardless of size. If more than 1,000 Alabama residents are affected, the business must also notify the Alabama Attorney General within the same window.