A buried provision in Alabama's new data privacy law gives most independent auto shops a complete pass—but only if they meet one key condition.
Most Alabama auto service owners don't realize they may be entirely exempt from the state's new data privacy law. That's because HB351, which takes effect May 1, 2027, contains a provision that exempts small businesses from nearly all of its requirements—and it could apply to you.
Under Section 4(a)(7) of HB351, any business with fewer than 500 employees that does not sell personal data is completely exempt from the Alabama Personal Data Protection Act. This isn't a partial exemption or a grace period. It means zero compliance obligations.
If you qualify, you don't have to:
For most independent and regional auto repair shops, transmission shops, tire retailers, and collision centers, this is significant relief. The law's compliance burden simply doesn't apply to you.
The exemption has one condition: your business must not sell personal data. That's the operative phrase. If you collect customer names, phone numbers, vehicle information, or payment details—but don't sell that data to third parties—you're exempt.
Most auto service businesses don't sell customer data. They use it to manage appointments, process repairs, handle billing, and maintain service records. That use case fits the exemption.
However, if your shop does sell customer data—whether to marketing firms, data brokers, or other third parties—the exemption doesn't apply, and you'll need to comply with the full law when it takes effect.
HB351 doesn't take effect until May 1, 2027, which gives you time. But understanding where you stand matters for planning. If you're exempt, you can avoid investing in compliance infrastructure. If you're not—because you do sell data—you'll need to prepare.
The law also matters if you're considering changes to how you handle customer information. If you've thought about selling customer lists or partnering with data brokers, that decision directly affects your compliance obligations starting in 2027.
First, confirm whether your shop sells personal data. If the answer is no, document that decision. Second, if you do sell data, start reviewing what the full compliance requirements will be—privacy notices, consumer request processes, and security standards are all coming.
The exemption is real and substantial for most small shops. But it only applies if you meet the condition. Understanding that distinction now prevents surprises later.
Source: HB351, Section 4(a)(7), Page 9; effective date Section 12, Page 29. Alabama Legislature.