Skip to content

Cyber Liability by state

Arizona data breach notification law and cyber insurance

Direct answer

What is Arizona's data breach notification law?

Arizona's breach notification law (Ariz. Rev. Stat. sect. 18-552) requires businesses to notify affected residents within 45 days after determining that a breach has occurred after a breach of personal information. Arizona requires businesses to notify affected residents within 45 days of confirming a breach of unencrypted personal information.

Reviewed by Cornerstone Staff28 years of financial services state licensing experienceLast verified July 29, 2026

What the statute requires

Arizona requires businesses to notify affected residents within 45 days of confirming a breach of unencrypted personal information. Cyber liability insurance generally funds the forensic investigation, legal review, and notification costs this statute triggers, and it can respond to regulatory inquiries from the Attorney General.

Consumer notification deadline
Within 45 days after determining that a breach has occurred
Regulator notice
Notify the Arizona Attorney General and the three largest nationwide consumer reporting agencies within 45 days when a breach requires notice to more than 1,000 residents.
Credit bureau notice
Notify the three largest nationwide consumer reporting agencies within 45 days when more than 1,000 residents are notified.
Safe harbor
Notification is not required if the compromised data was encrypted or redacted and the encryption key was not acquired.
Enforcement
The Attorney General may enforce violations and seek civil penalties, subject to statutory caps tied to the number of affected residents and breaches.

Statutes and sources

  • Arizona Data Breach Notification Law

    Ariz. Rev. Stat. sect. 18-552

Regulator: Arizona Attorney General . Last verified 2026-07-29 from the official source .

Get Arizona coverage handled

Share a few details and an agent will respond within one business day.