Arizona has no comprehensive consumer privacy statute, so obligations there come from its breach-notification law, sector-specific rules and federal statutes. This page collects our coverage touching Arizona. For the underlying law rather than the news, see our Arizona privacy law page.
Breach Notification
November 9, 2026
Arizona's breach article opens with a duty to investigate any security incident, then gives the data owner 45 days from the determination that a breach occurred. Above 1,000 individuals, filings go to three credit bureaus, the Attorney General and the state homeland security director. Only the Attorney General may enforce, under a penalty ceiling of $500,000.
Read more →
Genetic Privacy
November 9, 2026
Arizona protects genetic test results through a small chapter in its civil procedure title, not through a single privacy act. A.R.S. 12-2802 makes the results privileged to the person tested and lists who may receive them. Title 20 adds an insurer consent rule, and a separate consumer testing chapter borrows 12-2802 as its disclosure standard.
Read more →
GLBA
November 9, 2026
Arizona has no statute based on the NAIC data security model, but Chapter 11 of Title 20 governs how insurers, producers and support organizations handle personal information. It sets notice duties in section 20-2104, gives individuals access and correction rights, limits disclosure under section 20-2113 and provides limited private remedies.
Read more →