1. Home
  2. State breach laws
  3. Arizona

Arizona data breach notification law

What Arizona requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Ariz. Rev. Stat. §§ 18-551 and 18-552.

45 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Arizona's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required once 1,000 or more residents are affected, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Arizona breach filings →

Requirements in detail

Statute
Ariz. Rev. Stat. §§ 18-551 and 18-552
Deadline to notify residents
Within 45 days after the entity's investigation determines that a security system breach occurred. If law enforcement requests a delay, notices are due within 45 days after law enforcement says notification will no longer compromise the investigation.
Attorney General notification
Yes, if more than 1,000 individuals must be notified. Within the same 45 days, the entity must notify the Attorney General, the Director of the Arizona Department of Homeland Security, and the three largest nationwide consumer reporting agencies.
Penalties
A knowing and willful violation is an unlawful practice that only the Attorney General may enforce. The civil penalty cannot exceed the lesser of $10,000 per affected individual or the total economic loss suffered by affected individuals, and the maximum for a breach or series of related breaches is $500,000.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Arizona's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Arizona has no law limiting breach lawsuits for organizations that maintain a security program.

Arizona breach notification FAQ

What is the data breach notification deadline in Arizona?

Within 45 days after the entity's investigation determines that a security system breach occurred. If law enforcement requests a delay, notices are due within 45 days after law enforcement says notification will no longer compromise the investigation. The governing law is Ariz. Rev. Stat. §§ 18-551 and 18-552.

Does Arizona require notifying the Attorney General of a data breach?

Yes, if more than 1,000 individuals must be notified. Within the same 45 days, the entity must notify the Attorney General, the Director of the Arizona Department of Homeland Security, and the three largest nationwide consumer reporting agencies.

What are the penalties for failing to report a data breach in Arizona?

A knowing and willful violation is an unlawful practice that only the Attorney General may enforce. The civil penalty cannot exceed the lesser of $10,000 per affected individual or the total economic loss suffered by affected individuals, and the maximum for a breach or series of related breaches is $500,000.

Can individuals sue over a data breach in Arizona?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Arizona?

Arizona's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Arizona limit breach lawsuits for companies with a cybersecurity program?

No. Arizona has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Arizona Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →