LexLint

Know the law where your app runs.

Law / United States / Arizona

Discarding and disposing of records containing personal identifying information

A.R.S. sec. 44-7601

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 1 January 2005.

A security baseline statutes rule binding public and private bodies.

As of 16 September 2026.

What it requires

  • This binds any 'entity': a corporation, foreign corporation, unincorporated association, sole proprietorship, partnership, trust, estate, joint venture, limited liability company, or a government, governmental subdivision or agency, that discards or disposes of a paper record or document containing an individual's first and last name, or first initial and last name, combined with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number.
  • Redact that personal identifying information, or destroy the paper record or document, before discarding or disposing of it. This duty reaches paper records and documents only; it states no separate duty over electronic data.
  • An entity subject to the Gramm-Leach-Bliley Act, a HIPAA covered entity or business associate, or an entity subject to the federal Fair Credit Reporting Act is exempt. An entity that maintains and complies with its own disposal procedures, consistent with this duty, is deemed compliant.
  • A county attorney or the Attorney General may enforce this section, and a civil penalty applies per violation arising out of one incident: up to $500 for a first violation, $1,000 for a second violation, and $5,000 for a third or subsequent violation. The statute states no private right of action of its own.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

The civil penalty under subsection (C) is tiered by violation count within one incident: not more than $500 for a first violation, $1,000 for a second violation, and $5,000 for a third or subsequent violation. The $5,000 figure recorded here is the ceiling for a third or subsequent violation, not a flat per-violation amount.

Rule
Per violation only
As of
16 September 2026
Currency
USD
Per violation unit
Violation
Per violation amount
5,000

Who enforces it

Enforcement body

A county attorney in the county in which the records or documents were wrongfully discarded or disposed, or the Attorney General, under A.R.S. sec. 44-7601(B). Where the same entity violates the section in multiple counties, a county attorney may file a notice of intent to enforce and request that the actions be consolidated.

What it reaches

Obligation class

Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

An 'entity' may not knowingly discard or dispose of a paper record or document that combines an individual's first and last name, or first initial and last name, with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number, without first redacting that information or destroying the record or document.

'Entity' is defined broadly to include a corporation, unincorporated association, sole proprietorship, partnership, trust, or a government, governmental subdivision or agency. The duty applies to paper records and documents only. It does not reach an entity already regulated under the Gramm-Leach-Bliley Act, HIPAA, or the federal Fair Credit Reporting Act. An entity that maintains and follows its own consistent disposal procedures is deemed compliant.

A county attorney or the Attorney General may enforce the section, and a civil penalty applies per violation arising out of one incident, rising from up to $500 for a first violation to up to $5,000 for a third or subsequent violation.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

Official statute text, Arizona Revised Statutes, Arizona State Legislature

Back to the example  ·  Lint your app