The Arizona rule in full 45 days
Ariz. Rev. Stat. §§ 18-551 to 18-552
- Notify residents
- Within 45 days after determining a breach occurred. If law enforcement asks for a delay, the 45 days start when law enforcement says notice will no longer compromise the investigation.
- Notify the state
- Notify the Attorney General and the Director of the Arizona Department of Homeland Security in writing within 45 days after determining the breach, if the breach requires notice to more than 1,000 individuals.
- Credit bureaus
- More than 1,000 residents notified.
- No-harm exception
- No notice is needed if the business, an independent third-party forensic auditor or a law enforcement agency finds after a reasonable investigation that the breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals. No documentation or AG notice is required.
- Encryption
- Only unencrypted and unredacted data is covered. The statute has no separate exception for a stolen key.
- Data covered beyond the basic set
- Online account credentials, digital signature, health insurance information, medical information, passport number, taxpayer ID, biometric data.
- Enforcement
- Only the Attorney General may enforce, and only for knowing and willful violations. The civil penalty may not exceed the lesser of $10,000 per affected individual or the total economic loss, with a cap of $500,000 for a breach or series of related breaches. The AG may also seek restitution.
- Also know
- A business must promptly investigate any security incident. A vendor that maintains data must notify the owner as soon as practicable after discovering a breach. Businesses covered by HIPAA or the Gramm-Leach-Bliley Act are exempt. Taxpayer ID includes an IRS identity protection PIN. The Department of Homeland Security notice was added in 2022.
Law: Ariz. Rev. Stat. §§ 18-551 to 18-552 | A.R.S. 18-551 definitions. Read from the statute and checked by a second reviewer on October 13, 2026. Compare all states.
Neighboring states: California, Nevada, Utah, New Mexico, Colorado. A breach that reaches their residents brings in their rules too.
Dealing with a breach right now? Two short steps. A security provider follows up by email within one business day.
Get a quote for my businessThe Arizona data breach notification law starts with an investigation
The first duty is to look. Any security incident must be investigated promptly, and once that work confirms a breach, the 45-day count begins 1.
Police can move the start date. When law enforcement asks for a hold, day one becomes the day it says notice will no longer compromise its investigation 1.
Arizona protects far more than Social Security and card numbers: online logins, digital signatures, medical and health insurance details, passport and taxpayer ID numbers (an IRS identity protection PIN among them) and biometric data 2.
Two state offices to notify above 1,000
A breach requiring letters to more than 1,000 individuals means two written state filings inside the same 45 days, one to the Attorney General and one to the Director of the Arizona Department of Homeland Security 1. The Homeland Security copy dates from 2022, so a checklist written before then will leave it off. The credit bureaus come in at that same line 1.
HIPAA and Gramm-Leach-Bliley entities sit outside the Arizona statute 1 and follow federal rules, for a clinic the HIPAA patient notice rule.
Want a second opinion on your setup? Send a short request and one provider follows up by email within one business day. How it works.
Get a quote for my businessWhen notice is not required
Arizona measures harm in dollars. Letters are not required when the business, an independent third-party forensic auditor or a law enforcement agency concludes after a reasonable investigation that the breach has not caused, and is not reasonably likely to cause, substantial economic loss to the people affected 1. No written finding is required, though an outside forensic report makes the strongest record.
Encrypted or redacted data is out of scope 2. A stolen key gets no separate treatment, so talk to counsel before leaning on encryption when the key may have gone too.
Penalties only for knowing and willful violations
Enforcement belongs to the Attorney General alone and reaches only knowing and willful violations 1. The penalty is capped at the lesser of $10,000 per affected individual or the total economic loss, and at $500,000 for one breach or a series of related ones 1, with restitution also available. Consumers cannot sue under this statute.
A payroll, hosting or software vendor that holds records for a client must alert that client as soon as practicable after discovering a breach 1.
Your first calls after an Arizona breach
With the attack under way, an insured Arizona business calls its carrier ahead of everyone else and then files at ic3.gov for the FBI; reimaging machines before the evidence is copied can erase what investigators need 456. Ask the carrier which law firm it approves before you hire one; the controls and conditions carriers check are listed separately.
Once the carrier is on board, a response firm or the IT company you already use contains the damage. Then group people by home state: a California resident brings a 30-day deadline, and every state's breach rule is in our comparison table. IC3's 2025 report counted 28,868 complaints from Arizonans and about $631 million lost, sixth among the states 3. For ongoing support pricing, see our guides to managed IT in Phoenix, Scottsdale and Tucson.
As of October 13, 2026, this matched A.R.S. 18-552. Do not treat a summary as legal advice; whether HIPAA or GLBA takes you outside the state law is a question for an Arizona lawyer.
Common questions
What is the notice window in the Arizona data breach notification law?
Forty-five days from determining a breach occurred 1. A police hold moves the start to the day law enforcement clears notice.
Who do you notify in Arizona besides affected individuals?
Past 1,000 people, the Attorney General and the Director of the Arizona Department of Homeland Security get written notice within the 45 days, and the credit bureaus are told 1.
Is encrypted data exempt under Arizona law?
Yes, along with redacted data 2. A stolen key is not separately addressed.
When can Arizona penalize a business under its breach law?
Only when the violation is knowing and willful. The penalty then runs up to the lesser of $10,000 per affected individual or the total economic loss, never above $500,000 per breach or series of related breaches, plus restitution 1.
Does the Arizona law apply to HIPAA-covered businesses?
No. HIPAA and GLBA entities are exempt and follow federal rules instead 1.
Sources
- Arizona State Legislature, Ariz. Rev. Stat. §§ 18-551 to 18-552 (A.R.S. 18-552), 2026.
- Arizona State Legislature, A.R.S. 18-551 definitions, 2026.
- FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report (States by Complaint Count, p.28; States by Complaint Loss, p.29), 2026-04.
- Federal Trade Commission, Data Breach Response: A Guide for Business, 2025-06-20.
- FBI, Ransomware, 2026-04-08.
- Federal Trade Commission, Cyber Insurance, 2021-11-09.
Updated October 13, 2026.