Law / United States / 
Arizona
Arizona data breach notification law
In force.
A breach notification rule binding public and private bodies.
- Private right of action
- No
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Notify each affected Arizona resident of a breach of system security involving their personal information within 45 days after determining the breach occurred.
- Notify the Arizona Attorney General and the director of the Arizona Department of Homeland Security, in writing, within 45 days after determining the breach occurred, and the three largest nationwide consumer reporting agencies, if the breach requires notification of more than 1,000 individuals (A.R.S. 18-552(B)).
- Where a law enforcement agency has delayed the notifications, make them within 45 days after the agency tells you that they no longer compromise its investigation (A.R.S. 18-552(D)).
- Treat a person's unique biometric data generated to authenticate access to an online account as personal information capable of triggering this notification duty. Biometric data collected for a purpose other than online-account authentication is not covered by this statute's biometric element.
- Expect this statute to be enforced exclusively by the Arizona Attorney General as an unlawful practice under the Arizona Consumer Fraud Act. It creates no private right of action.
These lines are LexLint's reading of the law's text. Also read by: Arizona Attorney General's Office (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.azag.gov/consumer/data-breach/faq
- Guidance body
- Arizona Attorney General's Office
- Open questions
- What amount or kind of loss is 'substantial economic loss to affected individuals' under A.R.S. 18-552(J), which excuses notice where a breach 'is not reasonably likely to result in substantial economic loss'?
What it makes you log
Logging duty
Section 18-552 requires a person that conducts business in the state to investigate a security incident, to notify affected individuals within 45 days of determining that a breach occurred, and to notify the credit reporting agencies, the Attorney General and the director of the Department of Homeland Security where more than 1,000 individuals are affected. A person need not notify where a reasonable investigation determines that the breach has not resulted in and is not reasonably likely to result in substantial economic loss (subsection J), but the text does not require that determination to be written down or kept. The letter to the Attorney General that demonstrates the facts for substitute notice (subsection F) is a filing, and the information security policy in subsection O binds only the public safety bodies it names.
- Kind
- None
- As of
What this law does
Arizona's breach-notification statute requires a person that conducts business in the state and owns or licenses unencrypted and unredacted computerized personal information of an Arizona resident to notify the affected individuals within 45 days after determining that a security system breach occurred.
The duty runs to any 'person' that conducts business in the state, a term A.R.S. sec. 18-551(6) defines to include a government or governmental subdivision or agency alongside a natural person or business entity, except the department of public safety, a county sheriff's department, a municipal police department, a prosecution agency and a court, so the duty is not private-sector-only.
If the breach affects more than 1,000 individuals, the person must also notify the three largest nationwide consumer reporting agencies, the Arizona Attorney General, and the director of the Arizona Department of Homeland Security. Notice may be delayed for an active law enforcement investigation, and no notice is required at all if a reasonable investigation determines there is no substantial risk of economic loss. Gramm-Leach-Bliley Act (GLBA)- and Health Insurance Portability and Accountability Act (HIPAA)-regulated entities are exempt.
The statute creates no lawful-basis, purpose-limitation, or data-subject-rights framework for ordinary processing; it governs breach response only. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .