# Arizona — US state data breach notification deadlines by state

For Arizona, statute citation is A.R.S. § 18-552; individual notice deadline is within forty-five days after the determination; individual notice hard deadline (days) is 45; ag / regulator notice deadline is within forty-five days after the determination; ag notice resident-count trigger is more than one thousand individuals, recorded from its source on 2026-08-18.

- **State:** Arizona _(verified: appears in the quote below)_
- **Statute citation:** A.R.S. § 18-552
- **Individual notice deadline:** within forty-five days after the determination _(verified: appears in the quote below)_
- **Individual notice hard deadline (days):** 45 _(our reading, not quoted from the source)_
- **AG / regulator notice deadline:** within forty-five days after the determination _(verified: appears in the quote below)_
- **AG notice resident-count trigger:** more than one thousand individuals _(verified: appears in the quote below)_
- **Consumer reporting agency notice trigger (residents):** more than one thousand individuals _(verified: appears in the quote below)_
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** GLBA-covered entities and HIPAA covered entities and business associates are exempt (subsection N). AG notice and notice to the three largest nationwide consumer reporting agencies are both required at the same threshold: more than one thousand individuals affected. Notice to both the attorney general and the Director of the Arizona Department of Homeland Security is required. _(our reading, not quoted from the source)_

## What the source says

> B. If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data, within forty-five days after the determination, shall: 1. Notify the individuals affected pursuant to subsection E of this section and subject to the needs of law enforcement as provided in subsection D of this section. 2. If the breach requires notification of more than one thousand individuals, notify both: (a) The three largest nationwide consumer reporting agencies. (b) The attorney general and the director of the Arizona department of homeland security, in writing, in a form prescribed by rule or order of the attorney general or the director of the Arizona department of homeland security or by providing the attorney general or the director of the Arizona department of homeland security with a copy of the notification provided pursuant to paragraph 1 of this subsection.

## Source

- https://www.azleg.gov/ars/18/00552.htm

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).