Skip to content
Network USA

AZ · Breach notification statute

Arizona data breach notification law

A summary of the Arizona breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Ariz. Rev. Stat. §§ 18-551 to 18-552 (Data Security Breaches (Network Security)) (amended 2022)

Last amended
2022 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

45 days Arizona requires businesses and persons to notify affected individuals within 45 days after

Attorney general notice

Yes Arizona requires notification to both the Attorney General and the Director of the Arizona

What counts as a breach

In Arizona 'breach' or 'security system breach' means an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals. It does not include a good faith acquisition of personal information by a person's employee or agent for the purposes of the person if the personal information is not used for a

What counts as personal information

In Arizona 'personal information' means either: (i) an individual's first name or first initial and last name in combination with one or more specified data elements, or (ii) an individual's user name or e-mail address in combination with a password or security question and answer that allows access to an online account. It does not include publicly available information lawfully made available from government records or widely distributed media.2

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Arizona

167 reports to HHS OCR affecting 16,201,503 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Arizona.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Banner HealthHealthcare Provider3,620,000Aug 3, 2016Hacking/IT IncidentArchive (closed)
Medical Management Resource Group, L.L.C.Business Associate2,264,157Feb 6, 2024Hacking/IT IncidentArchive (closed)
OnePoint Patient CareHealthcare Provider1,741,152Oct 14, 2024Hacking/IT IncidentArchive (closed)
SimonMed ImagingHealthcare Provider1,275,669Mar 27, 2025Hacking/IT IncidentArchive (closed)
Magellan Health Inc.Health Plan1,013,956Jun 12, 2020Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Arizona businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Arizona timing rule as: "45 days Arizona requires businesses and persons to notify affected individuals within 45 days after". (Source: PRC 2026 survey extract.)

Does Arizona require notice to the attorney general?

The PRC 2026 extract notes: "Yes Arizona requires notification to both the Attorney General and the Director of the Arizona". (Source: PRC 2026 survey extract.)

Does the Arizona law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Arizona breach law.

Does the Arizona law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Arizona breach law.

Does the Arizona law cover paper records?

No. The PRC 2026 survey records the Arizona law as covering computerised data only, not paper records.

Is there a private right of action in Arizona?

No. The PRC 2026 survey does not record a private right of action under the Arizona breach law.

Is credit monitoring required in Arizona?

No. The PRC 2026 survey does not record a credit monitoring requirement in Arizona.

How does the Arizona law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Arizona statute, and see our HIPAA vs state breach notification laws guide.

Sources