Ashleigh Bickford and Gregory Leighton discuss the growing legal and operational challenges organizations face as technology, privacy and cybersecurity risks continue to evolve in 2026. They highlight how increased regulatory scrutiny, AI adoption and data governance obligations are reshaping compliance expectations across industries, particularly around privacy controls, vendor management and risk oversight. Bickford and Leighton emphasize that organizations must move beyond paper compliance and ensure their technology, privacy and security programs function effectively in practice to reduce litigation, enforcement and operational risk.

Alabama has joined the expanding patchwork of states enacting consumer privacy laws, with a new statute that will require many businesses to reassess how they collect, use and sell personal data. On April 16, 2026, Governor Kay Ivey signed into law the Alabama Personal Data Protection Act (APDPA), a comprehensive consumer data privacy law. The APDPA will take effect on May 1, 2027. The law applies to many companies doing business in Alabama or targeting its residents and introduces obligations around consumer rights, data use and transparency. Key Takeaways: The APDPA largely follows the “Virginia model” of comprehensive consumer privacy laws, so many requirements will be familiar to companies with existing privacy programs. The APDPA’s scope combines a low processing threshold with a