Privacy Map

Arizona. Breach notification. Act

AZ breach lawArizona data breach notification law (Ariz. Rev. Stat. §§ 18-551 to 18-552)

In force
Partly verifiedMedium confidence. No verification notes recorded.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Arizona residents to notify affected individuals after a security breach. Core timing rule: Individuals within 45 days of determining a breach. Covered data: name plus SSN, driver's licence, financial account with codes, private keys, health insurance ID, medical/mental health data, passport, taxpayer ID/IRS IP PIN, and biometric data for authentication; also online credentials alone.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Dual regulator notice (AG plus state homeland security agency); no-notice exception requires a finding of no substantial economic loss, which can be made by a forensic auditor or law enforcement.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Arizona requires the maintaining entity to notify the owner or licensee as soon as possible and cooperate. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals within 45 days of determining a breach; AG and Arizona Dept of Homeland Security if >1,000 residents; three largest CRAs if >1,000
DPO
No
Cross-border transfers
None
Maximum penalty
Lesser of $10,000 per affected individual or total economic loss, capped at $500,000 per breach

§3Dates

Key dates
  • Adopted
  • In force
  • Rewritten by HB 2154 (2018); HB 2146 (2022, eff. 2022-06-27) added notice to the Arizona Department of Homeland Security

§4Text and authority

Text
Authority
Arizona Attorney General

§5Where it applies

Domestic law of
Arizona

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. No verification notes recorded.