Alabama Data Breach Notification Act of 2018

Requires covered entities to protect sensitive personally identifying information with reasonable security measures, investigate suspected breaches, and notify affected Alabama residents within 45 days when a breach is reasonably likely to cause substantial harm. Larger breaches also require notice to the Attorney General and the national consumer reporting agencies, and records must be disposed of securely.