Arizona

The Attorney General is responsible for enforcing the date breach notification statute in Arizona. The Attorney General may, bring an action violation of the Arizona data breach notification statutes, and may impose a civil penalty for violating the notification statutes not to exceed the lesser of $10,000 per affected individual or the total amount of economic loss sustained by affected individuals. Id. at § 18-552(L). However, the maximum civil penalty is capped at $500,000. Id. This civil penalty maximum does not prevent the AG from recovering restitution for affected individuals. Id.