Data Breach Notice to Residents and State Authorities in Arizona

At a glance

Requirements one by one

Investigation, trigger, and exception

Arizona § 18-552(A) requires a business holding unencrypted and unredacted computerized personal information to investigate a suspected security incident promptly. Section 18-551(1) defines a breach by unauthorized access and acquisition that materially compromises the information. Covered data include a name with one of the listed identification, financial, health, passport, tax, biometric, or authentication elements, or online account credentials under § 18-551(7), (11). The affected individual is an Arizona resident whose principal Arizona mailing address appears in the business's records at the time of the breach under § 18-551(4).

Under § 18-552(J), notification is unnecessary if the business, an independent forensic auditor, or law enforcement determines after a reasonable investigation that substantial economic loss has not occurred and is not reasonably likely. This is a specific economic-loss screen.

Recipients and the 45-day clock

Section 18-552(B) gives the owner or licensee 45 days after determining a security system breach to notify affected individuals. More than 1,000 people requiring notice triggers notices within the same period to the three largest nationwide consumer reporting agencies, the Attorney General, and the Arizona Department of Homeland Security. The two state authorities receive a written notice in the prescribed form or a copy of the resident notice. A nonowner maintainer informs the owner or licensee as soon as practicable and cooperates under subsection (C).

Delivery and substitute notice

Section 18-552(E) requires at least the approximate breach date, a short description of affected information, contact details for the three largest nationwide agencies, and federal identity-theft assistance contacts. Subsection (F) permits writing, email when addresses are held, or a live telephone conversation. Substitute notice applies when ordinary delivery would cost more than $50,000, the affected class exceeds 100,000, or contact information is insufficient. It consists of a justification letter to the Attorney General and a conspicuous website notice for at least 45 days if the business has a site.

What trips people up

A law-enforcement hold changes the clock. Section 18-552(D) permits delay if an agency advises that notification would impede a criminal investigation. Once the agency says notice no longer compromises it, the business has 45 days to give required notices.

Email-account credentials need a different destination. Under § 18-552(G), a credential-only notice may tell the person to change passwords or security answers for affected and reused accounts. A provider of the breached email account may use another permitted method or the specified online notice from a customary access location. A forced password reset can satisfy its own-account notice only with the required advice about other accounts.

Common questions

Does the 45-day clock start when an incident is suspected? No. Section 18-552(A) requires prompt investigation then subsection (B) starts the notice period after the breach determination.

Can an internal policy replace notice? Section 18-552(H) recognizes a consistent policy followed in an incident, including its 45-day timing requirement. Subsections (I) and (N) separately address specified federal regulator procedures and excluded financial or health entities.

Statutes and sources

• Ariz. Rev. Stat. §§ 18-551 and 18-552 — breach definitions, risk screen, recipients, clocks, methods, and exceptions. https://www.azleg.gov/ars/18/00552.htm (accessed 2026-10-14)