Arizona Revised Statutes (A.R.S.) Title 44, Chapter 32

This statute requires businesses and government agencies to notify individuals if there is a breach of their personal information.

JurisdictionArizona
CategoryCybersecurity
StatusActive
Latest development

Analysis

Key Requirements

Arizona Revised Statutes (A.R.S.) Title 44, Chapter 32 outlines several key requirements for businesses and government agencies regarding data breach notifications:

  • Conduct an investigation: When a person or entity becomes aware of an incident of unauthorized acquisition and access to unencrypted computerized data that includes personal information, they must conduct a reasonable investigation to promptly determine if there has been a breach of the security system[](https://www.azleg.gov/ars/18/00552.htm).
  • Notify affected individuals: If a breach has occurred, the entity must notify affected individuals within 45 days of determining that a breach has resulted in or is reasonably likely to result in substantial economic loss to affected individuals[](https://www.azleg.gov/ars/18/00552.htm).
  • Notification content: The notification must include the approximate date of the breach, a brief description of the personal information involved, toll-free numbers and addresses for the three largest nationwide consumer reporting agencies, and the toll-free number, address, and website address for the Federal Trade Commission[](https://www.azleg.gov/ars/18/00552.htm).
  • Notify regulatory bodies: If the breach requires notification of more than 1,000 individuals, the entity must also notify the three largest nationwide consumer reporting agencies and the Arizona Attorney General's Office[](https://www.azag.gov/consumer/data-breach/faq).
  • Delay for law enforcement: Notifications may be delayed if a law enforcement agency advises that the notifications will impede a criminal investigation[](https://www.azleg.gov/ars/18/00552.htm).

Compliance Challenges

Organizations often face several challenges when complying with Arizona's data breach notification law:

  • Determining breach severity: Assessing whether a breach is likely to result in substantial economic loss to affected individuals can be complex and subjective[](https://www.natlawreview.com/article/arizona-adds-breach-notification-obligation).
  • Meeting the 45-day deadline: Conducting a thorough investigation and preparing notifications within the required timeframe can be challenging, especially for larger breaches[](https://www.hunton.com/privacy-and-information-security-law/arizona-amends-data-breach-notification-law).
  • Coordinating with law enforcement: Balancing the need for timely notification with potential criminal investigations can create compliance difficulties[](https://www.azleg.gov/ars/18/00552.htm).
  • Maintaining up-to-date contact information: Ensuring accurate contact details for affected individuals to facilitate timely notifications can be challenging for organizations[](https://www.centraleyes.com/privacy-laws/arizona/).

Implementation Best Practices

To effectively implement Arizona's data breach notification requirements, organizations should:

  • Develop an incident response plan: Create a comprehensive plan that outlines roles, responsibilities, and procedures for responding to potential data breaches[](https://www.nist.gov/cyberframework).
  • Conduct regular security assessments: Implement ongoing security evaluations to identify and address vulnerabilities before they lead to breaches[](https://www.cisa.gov/cyber-essentials).
  • Train employees: Provide regular training on data security best practices and breach response procedures[](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business).
  • Maintain accurate records: Keep detailed, up-to-date records of personal information stored and processed to facilitate quick identification of affected individuals in case of a breach[](https://www.nist.gov/privacy-framework).
  • Establish relationships with law enforcement: Develop connections with relevant law enforcement agencies to streamline communication in the event of a breach[](https://www.fbi.gov/investigate/cyber).

Recent Updates

As of July 22, 2022, Arizona implemented a new requirement:

  • Notify Arizona Department of Homeland Security: Companies must now notify the Arizona Department of Homeland Security when they experience a data breach impacting more than 1,000 Arizona residents[](https://www.natlawreview.com/article/arizona-adds-breach-notification-obligation).

This notification is in addition to existing requirements and must be made within 45 days after determining that a breach has occurred[](https://www.natlawreview.com/article/arizona-adds-breach-notification-obligation).

Related Regulations

Arizona's data breach notification law interacts with several other regulations:

  • Gramm-Leach-Bliley Act (GLBA): Financial institutions complying with GLBA notification requirements are deemed compliant with Arizona's law[](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act).
  • Health Insurance Portability and Accountability Act (HIPAA): Healthcare entities complying with HIPAA breach notification rules are considered compliant with Arizona's requirements[](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html).
  • California Consumer Privacy Act (CCPA): Organizations operating in both Arizona and California must navigate potentially overlapping requirements[](https://oag.ca.gov/privacy/ccpa).

Industry Impact

The Arizona data breach notification law has significant impacts across various industries:

  • Financial Services: Banks and credit unions must integrate these requirements with existing federal regulations, potentially requiring updates to their incident response procedures[](https://www.aba.com/banking-topics/technology/cybersecurity).
  • Healthcare: Medical providers and insurers need to align their breach notification processes with both HIPAA and Arizona's law[](https://www.aha.org/cybersecurity-and-risk-advisory-services).
  • Retail: E-commerce and brick-and-mortar retailers handling customer data must ensure their systems can quickly identify and notify affected Arizona residents in the event of a breach[](https://nrf.com/research/2022-retail-security-survey).

Sources

Recent developments

  • — Arizona’s 56th Legislature, 2nd Regular Session adjourned with no enacted bills amending A.R.S. Title 44, Chapter 32 in the 2026 session; the chapter’s text remains unchanged through early June 2026 based on the official statute repository. (source)
  • — A review of all 2026 regular‑session bill status pages referencing Title 44 shows no measures signed into law that modify Chapter 32, indicating no recent policy updates directly affecting this chapter in the last three months. (source)
  • — Recent press releases from the Arizona Attorney General’s Office reference enforcement actions under Title 44 generally but none specifically cite Chapter 32, suggesting enforcement focus has remained on other consumer and securities provisions rather than new initiatives tied to Chapter 32. (source)
  • — Arizona Corporation Commission securities division updates over the past quarter highlight rulemaking and enforcement under broader Title 44 securities authorities, but do not report any rule changes or guidance altering obligations unique to Chapter 32. (source)
  • — Arizona Commerce Authority industry briefings from Spring 2026 discuss general business and financial regulatory trends in the state without noting amendments or new compliance expectations specifically rooted in A.R.S. Title 44, Chapter 32. (source)
  • — Coverage in Arizona media outlets over the last three months referencing Title 44 has focused on consumer fraud, investor protection, and digital asset issues, with no articles identifying recent legislative or regulatory changes to Chapter 32 or significant industry controversy around it. (source)
  • — Legal research platform update logs for Arizona statutes as of late March 2026 show no pocket‑part or cumulative supplement revisions to A.R.S. Title 44, Chapter 32 in the prior quarter, indicating that practitioners are still relying on the same statutory text and interpretive case law as before. (source)
  • — Commercial legal databases’ “recently updated” flags for Arizona statutes list activity in other parts of Title 44 (e.g., consumer protection and securities registration sections), but not Chapter 32, reinforcing that there have been no recognized textual or editorial changes to this chapter in the last three months. (source)
  • — Industry commentary from Arizona financial and business trade groups in early Spring 2026 addresses broader regulatory issues (federal consumer rules, fintech oversight, state securities enforcement) and does not report any specific operational or compliance impacts tied to new developments in Title 44, Chapter 32. (source)
  • — Arizona State Bar practice‑area updates for business and securities lawyers during March 2026 mention legislative monitoring of Title 44 generally but do not flag Chapter 32 as an area of recent change, indicating that industry and practitioner reaction has been minimal due to the lack of new amendments or guidance. (source)

Read the full guide to Arizona Revised Statutes (A.R.S.) Title 44, Chapter 32

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates