Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Arizona |
|---|---|
| Statute citation | Ariz. Rev. Stat. §§ 18-551 to 18-552 (Data Security Breaches (Network Security)) (amended 2022) |
| Individual notice timing | 45 days Arizona requires businesses and persons to notify affected individuals within 45 days after |
| Attorney general notice | Yes Arizona requires notification to both the Attorney General and the Director of the Arizona |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Arizona 'breach' or 'security system breach' means an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals. It does not include a good faith acquisition of personal information by a person's employee or agent for the purposes of the person if the personal information is not used for a |