A little-known carve-out in Alabama's new data privacy law could mean your shop has zero compliance duties—if you meet one simple condition.
Most Alabama auto service owners don't realize they may be entirely exempt from the state's new data privacy law. That exemption hinges on a single provision buried in HB351, and understanding it now—before the law takes effect—could save you significant compliance work and legal exposure.
Under Section 4(a)(7) of HB351, any business with fewer than 500 employees that does not sell personal data is completely exempt from all obligations under the Alabama Personal Data Protection Act. That means no privacy notices, no infrastructure to handle consumer rights requests, no data security mandates, no processor contracts, and no exposure to the $15,000-per-violation civil penalty.
This is the single broadest carve-out in the bill. For most independent and regional auto shops, it's potentially game-changing.
If your auto service business has fewer than 500 employees and you do not sell customer personal data to third parties, you are exempt. Full stop. You do not need to:
The exemption applies to data you collect—customer names, phone numbers, vehicle information, payment details, service history, and anything else tied to your business.
The exemption has one requirement: you cannot sell personal data. "Selling" data means sharing it with a third party for monetary consideration. If you share customer information with a service provider (like a payment processor or shop management software vendor), that is not a sale—it's a business necessity and doesn't disqualify you from the exemption.
However, if you sell customer lists, analytics, or other personal information to marketers, data brokers, or other buyers, you lose the exemption entirely and become subject to all HB351 obligations.
HB351 becomes effective May 1, 2027. You have until then to assess whether your shop qualifies for the exemption and, if it does, to confirm you have no data sales arrangements in place.
Count your employees. If you're under 500, confirm that you don't sell customer data. If both are true, document that fact. If you're unsure whether any of your vendor relationships constitute a "sale," review those contracts now. You don't need to take action on HB351 compliance if you're exempt—but you do need to know whether you are.
If you're at or above 500 employees, or if you do sell data, you'll need to begin planning for full compliance well before May 2027.
Source: HB351, Section 4(a)(7), Page 9; Section 12, Page 29 (effective date).