If a covered entity discovers circumstances requiring notice under Section 8-38-5 of more than 1,000 individuals at a single time, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in the Fair Credit Reporting Act, 15 U.S.C. §1681a, of the timing, distribution, and content of the notices.(Act 2018-396, §7.)
Alabama Legal Code
Section 8-38-7 - Notice of Security Breach - Consumer Reporting Agencies
Source: https://alison.legislature.state.al.us/code-of-alabama?section=8-38-7· Version 2026