Most Alabama auto service owners don't realize they may be entirely exempt from the state's new data privacy law—if they meet one simple condition.
Alabama's new Personal Data Protection Act, passed as HB351, includes a provision that could affect how—or whether—your auto service business needs to handle data privacy compliance. The surprise: most small shops probably don't know it exists.
Under Section 4(a)(7) of HB351, any business with fewer than 500 employees is completely exempt from the Alabama Personal Data Protection Act—provided that business does not sell personal data.
This is not a partial exemption. It is total. If your shop qualifies, you are not required to:
None of those obligations apply to you under this statute.
Most independent and regional auto service businesses fall well below 500 employees. If you operate one location or a small chain, you almost certainly qualify. The exemption applies to sole proprietors, partnerships, and corporations—the structure doesn't matter, only the headcount.
The critical condition: you cannot sell personal data. "Selling" data has a specific meaning in privacy law—it generally means exchanging customer information for money or other consideration. Sharing data with a third-party service provider (like a payment processor or shop management software) for business purposes is not a sale. Selling customer contact lists or vehicle history to data brokers would be.
If you don't sell data, the exemption applies automatically. You don't need to register, file anything, or notify anyone.
HB351 becomes effective May 1, 2027. That gives businesses nearly two years to understand their obligations—or confirm they have none. The exemption language is in Section 4(a)(7), found on page 9 of the bill.
If you operate an auto service with fewer than 500 employees and do not sell customer data, you have no compliance burden under this law. You can continue operating as you do now without new privacy policies, data request procedures, or security protocols mandated by HB351.
That said, this exemption applies only to Alabama's state law. Federal privacy rules, industry standards, and payment card security requirements (like PCI-DSS for credit card processing) remain in effect regardless of your size.
Also worth noting: the exemption is based on employee count as of the effective date. If your business grows to 500 or more employees, the exemption would no longer apply, and you'd need to comply with the full law going forward.
For now, most Alabama auto shops can file this away and focus on running their business. The law doesn't require action from you—it simply doesn't apply.
Source: Alabama HB351, Section 4(a)(7), effective May 1, 2027.