ShareAndGoShareAndGo

Data breach notification

Arizona data breach notification law

Arizona sets its notice rules in A.R.S. § 18-552, with the definitions in § 18-551.

Who must be told, and when

The duty applies to a person that conducts business in Arizona and owns, maintains or licenses unencrypted and unredacted computerized personal information.

WhoWhen and at what size
Affected individualsWithin forty-five days after the determination
Attorney General and the Director of the Arizona Department of Homeland SecurityWhen the breach requires notice to more than one thousand individuals
The three largest nationwide consumer reporting agenciesAlso when more than one thousand individuals must be notified

The forty-five days run from the determination, and the statute frames all three steps as things the person "shall" do within that period.

A broad list of data elements

Personal information is a first name or first initial and last name combined with one or more "specified data elements." A user name or email address with a password or security question and answer that allows access to an online account is personal information on its own.

The specified data elements include:

  • a Social Security number, or a driver's license or non-operating identification license number;
  • a private key that is unique to an individual and used to authenticate or sign an electronic record;
  • a financial account or card number with any required code or password;
  • a health insurance identification number, or medical or mental health treatment or diagnosis information;
  • a passport number, a taxpayer identification number, or an identity protection PIN issued by the IRS;
  • biometric data used to access an online account.

Anyone who holds credentials used to sign documents for clients should note the private key item in that list.

The substantial economic loss exception

Arizona lets a business skip individual notice if the person, an independent third-party forensic auditor or a law enforcement agency determines after a reasonable investigation that the breach has not resulted in, and is not reasonably likely to result in, substantial economic loss to affected individuals.

This test turns on economic loss rather than harm in general, and it names three kinds of investigator who can make the call.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

That watermark is a per-room setting and is on by default, so pages opened inside a room show who read them and on what day. Recipients confirm their email with a six-digit code and need no account, which means each log line names a confirmed address rather than a shared link. Because groups see only their own folders, the export is short to review: one CSV, one row per action, covering every reader of the room.

Arizona specifics

What is the Arizona deadline?
Within forty-five days after the determination, the person that owns or licenses the data must notify the individuals affected.
Which agencies hear about a large breach?
If more than one thousand individuals must be notified, the attorney general, the director of the Arizona Department of Homeland Security and the three largest nationwide consumer reporting agencies are all notified.
Does encrypted data trigger notice?
The duty is written for unencrypted and unredacted computerized personal information.
Is an email login covered?
Yes. A user name or email address with a password or security question and answer that allows access to an online account is listed.

When this was checked

Checked against Arizona's published law on November 2, 2026. This is general information, not legal advice.

Related pages

Breach notification laws by state

Breach notice rules across all 54 jurisdictions.

ShareAndGo vs DataRooms.com

A side by side look at two data rooms.

ShareAndGo

ShareAndGo home.