The Letter About Your Information
A.R.S. 18-552 — an investigation first, then notice within forty five days of finding a breach
In Arizona, a person that conducts business in the state and owns, maintains or licenses unencrypted and unredacted computerized personal information, on becoming aware of a security incident, conducts an investigation to promptly determine whether there has been a security system breach.
Forty five days. If the investigation finds a breach, the person that owns or licenses the data notifies the individuals affected within forty five days after the determination. Where more than one thousand individuals are to be notified, it also notifies the three largest nationwide consumer reporting agencies, the attorney general, and the director of the Arizona department of homeland security.
The notice to each individual includes at least:
- The approximate date of the breach.
- A brief description of the personal information included in it.
- The toll free numbers and addresses of the three largest nationwide consumer reporting agencies.
- The toll free number, address and website of the federal trade commission, or of a federal agency that assists consumers with identity theft.
The notices may be delayed when a law enforcement agency advises that they would impede a criminal investigation. Once the agency says they no longer compromise it, the notices go out within forty five days. Notice may be written, by email, or by a direct telephone call that is not a prerecorded message.
What counts as personal information, substitute notice, the rules for online account credentials, and the exceptions are in the section and are not reproduced in full here. Whether a notice was required or on time is a question for the attorney general, a court, and a licensed Arizona attorney.
Sources for this section (1)
- A.R.S. 18-552 — Notification of security system breaches; requirements; enforcement; confidentiality; civil penalty; preemption; exceptions
Legal information, not legal advice. Verified as of September 2026. Applying it to a particular situation is the work of a licensed Arizona attorney.