A.R.S. 18-552: Arizona's Investigation Duty, a 45-Day Clock and a $500,000 Penalty Ceiling

Investigation Comes Before the Breach

Arizona's first duty arises before anyone knows whether a breach has happened. Under A.R.S. 18-552(A), a person that conducts business in the state and "owns, maintains or licenses unencrypted and unredacted computerized personal information" that becomes aware of a security incident "shall conduct an investigation to promptly determine whether there has been a security system breach." The trigger word is defined in section 18-551, paragraph 10, as an event creating "reasonable suspicion that a person's information systems or computerized data may have been compromised or that measures put in place to protect the person's information systems or computerized data may have failed."

So the first legal duty attaches on suspicion, and it attaches to those that merely maintain data as well as to owners and licensees. The subsection sets no number of days for the investigation; the only timing word is "promptly." The Attorney General's published FAQ answers no to the question whether the law requires security or privacy policies to prevent breaches, explaining that it generally requires covered persons to act "only if and when a 'security incident' has already occurred."

When the 45 Days Start

The clock belongs to subsection B: if the investigation produces a determination that a breach occurred, "the person that owns or licenses the computerized data, within forty-five days after the determination, shall" give the required notices. Discovery of the incident does not start it. The period measures from the conclusion of the inquiry that subsection A demands, so the statute's own sequence is incident, investigation, determination, then 45 days.

An entity holding data it neither owns nor licenses sits outside that clock. Subsection C has it notify the owner or licensee "as soon as practicable" on discovering a breach and cooperate by sharing relevant information. Under an agreement with the owner, the custodian need not send the subsection B notices itself "unless the agreement stipulates otherwise."

Subsection D permits delay if a law enforcement agency advises that the notifications will impede a criminal investigation. When the agency reports that they no longer compromise it, the required notices follow "within forty-five days." Two deeming clauses sit alongside: subsection H treats a person following its own notification procedures as compliant with the individual notice duty if those procedures respect the forty-five-day period, and subsection I does the same for a person following the breach procedures of its primary or functional federal regulator.

Reach of the Definitions

"Person" in 18-551(6) includes a "government or governmental subdivision or agency," so public bodies are inside the article. Excluded are the department of public safety, county sheriff's departments, municipal police departments, prosecution agencies and courts. Subsection O of 18-552 gives those five groups a different assignment: each "shall create and maintain an information security policy that includes notification procedures" for its own breaches.

A security system breach requires "an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality" of unencrypted, unredacted computerized personal information, and the information has to be "maintained as part of a database of personal information regarding multiple individuals." Good faith acquisition by an employee or agent is carved out. An individual is a resident with a principal mailing address in Arizona "as reflected in the records of the person conducting business in this state at the time of the breach."

Personal information has two limbs. One is a name with a specified data element from paragraph 11:

• a Social Security number; a driver license or nonoperating identification license number;
• a private key unique to an individual and used to authenticate or sign an electronic record;
• a financial account or card number with any required code that allows access;
• a health insurance identification number, or information about medical or mental health treatment or diagnosis by a health care professional;
• a passport number, a taxpayer identification number or an IRS identity protection PIN; and
• unique biometric data used to authenticate an individual when accessing an online account.

The second limb needs no name: a "user name or e-mail address, in combination with a password or security question and answer, that allows access to an online account." Publicly available information from government records or widely distributed media is excluded.

A Separate Route for Stolen Logins

Subsection G relaxes the form of notice when only that second limb is involved. The notice may be electronic and may direct the individual to change the password and security question or to take other protective steps, for that account and for other accounts using the same credentials. If the compromised login belongs to an email account the person furnished, notice need not go to that address; another listed method or a clear and conspicuous online notice delivered from an IP address or location where the person knows the individual customarily logs in will do. Requiring a reset satisfies the duty for the account with that person if the individual is also told to change the same credentials elsewhere.

Content and Method of Individual Notice

Subsection E prescribes four items: the approximate date of the breach, a brief description of the personal information involved, the toll-free numbers and addresses of the three largest nationwide consumer reporting agencies, and the toll-free number, address and website of the Federal Trade Commission or another federal agency assisting with identity theft. The list stops there: it asks for no description of the incident itself and no account of remedial steps.

Subsection F allows written notice, email where the person has the addresses, or a direct telephone call that is "not through a prerecorded message." Substitute notice opens at a cost above $50,000, a class above 100,000 individuals, or insufficient contact information. It has two parts and neither involves the press: a written letter to the Attorney General showing the facts that justify it, and conspicuous website posting for at least forty-five days if the person maintains a site.

The Substantial Economic Loss Exception

Subsection J is the provision that can erase the notice duty altogether. No subsection B notification is required if "the person, an independent third-party forensic auditor or a law enforcement agency determines after a reasonable investigation that a security system breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals." The test concerns economic loss alone, the three decision makers are named, and the exception covers the bureau and regulator filings as well as the individual notices, since it refers to subsection B without limitation. Neither section defines "substantial economic loss."

Filings Above 1,000 Individuals

When the breach "requires notification of more than one thousand individuals," subsection B(2) adds two recipients on the same 45-day timetable: the three largest nationwide consumer reporting agencies, and, in writing, the Attorney General and the director of the Arizona Department of Homeland Security. Nothing in the section sets a smaller number for either, and the filing can be either a prescribed form or a copy of the notice sent to individuals.

The homeland security director is a later addition. Laws 2022, chapter 81 (HB 2146), approved March 29, 2022, inserted that office into subsections B and K. The Attorney General's FAQ still describes notification only to the three bureaus and to "the Arizona Attorney General's Office," while the office's submission form frames the question as more than 1,000 "residents of Arizona." The statute itself says individuals, a term limited to residents.

Subsection K makes these filings confidential under section 44-1525 and exempt from title 39's public records provisions, with one exception: substitute notices under subsection F are outside that protection.

Penalties and Who Can Pursue Them

Subsection L makes "a knowing and wilful violation of this section" an unlawful practice under section 44-1522 of the Consumer Fraud Act and provides that "only the attorney general may enforce such a violation." The penalty clause speaks of "a violation of this article" and limits the amount twice: not more than the lesser of $10,000 per affected individual or total economic loss sustained, and no more than $500,000 "from a breach or series of related breaches." Restitution for affected individuals remains available. Section 44-1531 separately allows the Attorney General to recover up to $10,000 per wilful violation of 44-1522 on petition to a court.

Subsection M declares breach notification a matter of statewide concern and preempts all municipal and county laws on the subject. Subsection N removes from the article any person subject to title V of the Gramm-Leach-Bliley Act and any HIPAA covered entity or business associate, along with supporting foundations that comply with applicable HIPAA provisions. The Gramm-Leach-Bliley and covered-entity exclusions turn on status alone; only the foundation clause adds a compliance condition. The current structure dates from Laws 2018, chapter 177 (HB 2154), approved April 11, 2018, which added 18-551 and renumbered former section 18-545 as 18-552.

What the Attorney General Has Announced

No fetched Arizona Attorney General release cites section 18-552 by number, so the record of actions under the section stands at zero for this post. Three multistate matters show the office pursuing breach conduct under broader labels. A release of October 5, 2023 reports a $49.5 million settlement with Blackbaud, of which Arizona was to receive more than $1.8 million, resolving allegations under "state consumer protection laws, data breach notification laws, and HIPAA." A June 22, 2022 release on a $1.25 million settlement with Carnival Cruise Line gives 4,849 affected Arizona residents and $52,177.22 to the state, stating that the investigation began "after breach notifications showed Carnival only reported the incident 10 months after it happened." A July 14, 2026 release on the 23andMe bankruptcy claims allocates Arizona $612,269 in civil penalties for a breach reaching more than 143,000 residents.

Frequently Asked Questions