Obligations United States Arizona
What a Arizona business has to have in writing
Arizona runs its own OSHA plan (ADOSH), was the first state to require E-Verify of every employer, and has a voter-approved earned paid sick time law with a written notice and paystub reporting duty.
Its data rules are a 45-day breach statute (with Attorney General and Homeland Security notice above 1,000 residents) and a paper-records disposal law, while state IT vendors must clear the AZRAMP program now moving to GovRAMP. Arizona has no comprehensive privacy, NAIC insurance data security, harassment-training or pay-transparency law.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
ArizonaHandbook 2026acknowledged by name
Arizona on Recordwith AllyMatter
Cover Arizona the Modern WayEvery policy Arizona makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Arizona on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Arizona rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Arizona data breach notification lawAI-compiledA.R.S. 18-551 and 18-552Any person or business operating in Arizona that owns, licenses or maintains unencrypted personal information; HIPAA and GLBA entities are carved outDistribute
Notice
Written notices to affected individuals within 45 days of determining a breach; when more than 1,000 Arizona residents are affected, additional notices to the Attorney General, the Director of the Arizona Department of Homeland Security and the three national credit bureaus.
From the first employee
Arizona Attorney General (Consumer Fraud Act; up to $500,000 per breach)
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Discarding and disposing of records containing personal identifying informationAI-compiledA.R.S. 44-7601Any entity holding paper records that pair a name with a Social Security, card, account or driver license number; GLBA, HIPAA and FCRA-regulated entities are exemptWrite
Written program
A written records-disposal procedure the business follows so that such records are redacted or destroyed before disposal; following one's own compliant procedure is treated as compliance.
From the first employee
County attorneys; Arizona Attorney General ($500 to $5,000 per violation)
AuthorityA.R.S. 44-7601 (Arizona Legislature)
Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
Arizona Division of Occupational Safety and Health (ADOSH) State PlanAI-compiledA.R.S. 23-401 et seq.; A.A.C. R20-5-601 et seq.Most private employers in Arizona plus state and local government (ADOSH enforces in place of federal OSHA)Write
Written program
Meet the federal standards as adopted by Arizona, post the bilingual Arizona Safety and Health Protection notice, and report fatalities and hospitalizations to ADOSH; Arizona adds no general written injury and illness prevention program mandate.
From the first employee
Industrial Commission of Arizona, ADOSH
State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state
LawProduceWhat it requiresTriggerEnforced by
Arizona Risk and Authorization Management Program (AZRAMP), transitioning to GovRAMPAI-compiledArizona Department of Homeland Security statewide policy; state procurement contract termsCloud and software vendors selling to Arizona state agencies; new contracts from July 1, 2025 and renewals from July 1, 2026 carry GovRAMP or FedRAMP requirementsCertify
Certification
A NIST 800-53-based security package and third-party assessment that earns GovRAMP Core, Ready or Authorized status (or a FedRAMP authorization) within the contract's timeline; existing AZRAMP authorizations stay valid until they expire.
From the first employee
Arizona Department of Homeland Security; State Procurement Office
Paid Leave Policies 1Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Earned paid sick time (Fair Wages and Healthy Families Act, Proposition 206)AI-compiledA.R.S. 23-371 to 23-381All Arizona employers; employers with fewer than 15 employees may cap use at 24 hours a year, larger employers at 40 hoursDistribute
Notice
Post the Industrial Commission's earned paid sick time notice, hand each new hire a written notice of the entitlement, terms of use, anti-retaliation rules and how to complain, and show accrued, used and paid sick time on or with each paycheck.
From the first employee
Industrial Commission of Arizona, Labor Department
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Arizona required workplace postersAI-compiledA.R.S. 23-364 (minimum wage and sick time notice); A.R.S. 23-906 (workers' compensation); A.R.S. 23-408 (safety)All Arizona employersPost
Posting
Display the state set from the Industrial Commission: minimum wage and earned paid sick time notices (English and Spanish), the workers' compensation notice, the ADOSH safety and health protection poster, and the bodily-fluid and MRSA/TB exposure notices, alongside federal posters.
From the first employee
Industrial Commission of Arizona
Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity registration (Arizona Corporation Commission)AI-compiledA.R.S. Title 10 (corporations); A.R.S. Title 29 Ch. 7 (LLCs)Corporations and LLCs formed in or doing business in Arizona; partnerships and trade names register with the Secretary of StateFile
Filing / record
File articles or a foreign registration with the Corporation Commission, publish the formation notice where the county requires it, and file annual reports for corporations (LLCs have no annual report). A transaction privilege tax license from the Department of Revenue is needed to sell taxable goods or services.
From the first employee
Arizona Corporation Commission; Arizona Department of Revenue
Contractor licensing (Registrar of Contractors)AI-compiledA.R.S. 32-1121 et seq.Anyone doing construction or repair work worth $1,000 or more in labor and materials, or any job needing a building permit regardless of priceCertify
Certification
Hold a Registrar of Contractors license in the right classification before bidding or contracting, backed by a license bond and a qualifying party who passed the trade and business exams; the license number goes on contracts and advertising.
From the first employee
Arizona Registrar of Contractors
Certified food protection manager (Arizona Food Code)AI-compiledA.A.C. R9-8-107, adopting FDA Food Code section 2-102.12Retail food establishments licensed by county health departments; compliance deadline for existing establishments was January 31, 2022Certify
Certification
Keep a person in charge on site during all hours of operation who holds an accredited food protection manager certificate, and hold the county food establishment permit; some counties also require food handler cards for staff.
From the first employee
Arizona Department of Health Services; county environmental health departments
Other Written Policies 2Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
E-Verify mandate (Legal Arizona Workers Act)AI-compiledA.R.S. 23-214Every Arizona employer, public or private, for hires made after December 31, 2007Certify
Certification
Enroll in federal E-Verify, run each new hire through it, and keep the verification record for the length of employment or three years, whichever is longer; violations risk suspension or revocation of business licenses.
From the first employee
Arizona Attorney General; county attorneys
Drug and alcohol testing policy (Drug Testing of Employees Act)AI-compiledA.R.S. 23-493 to 23-493.12Any employer that tests employees or applicants for drugs or alcohol and wants the statute's legal protectionsWrite + ack
Written policy
A written testing policy covering who is tested, when, which substances, methods, consequences of refusal or a positive result, employees' rights to results and to explain, and confidentiality, distributed to employees or included in the handbook.
From the first employee
Civil courts (statutory protections apply only to compliant employers)
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Arizona on top
Small businessFederal + industry, with Arizona on topConstruction contractorsFederal + industry, with Arizona on topHealthcare practicesFederal + industry, with Arizona on topFood and beverage businessesFederal + industry, with Arizona on topTax and accounting firmsFederal + industry, with Arizona on topRegistered investment advisersFederal + industry, with Arizona on topInsurance agenciesFederal + industry, with Arizona on topRetail and e-commerceFederal + industry, with Arizona on topTrucking and logistics carriersFederal + industry, with Arizona on topNonprofitsFederal + industry, with Arizona on topFederal contractorsFederal + industry, with Arizona on top
Other states
The same index for another state
Alabama12Alaska12Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Arizona Attorney General, Data-Breach FAQA.R.S. 18-552 (Arizona Legislature)AG notification formA.R.S. 44-7601 (Arizona Legislature)Arizona Department of Homeland Security, AZRAMP vendorsGovRAMP, State of Arizona program pageIndustrial Commission of Arizona, ADOSHFederal OSHA, Arizona State PlanA.R.S. 23-375 notice and posting (Arizona Legislature)Industrial Commission of Arizona FAQ (PDF)A.R.S. 23-372 accrualIndustrial Commission of Arizona, Posters Employers Must DisplayArizona Commerce Authority, Required Workplace PostersArizona Corporation Commission, Corporations DivisionArizona Department of Revenue, transaction privilege tax licenseArizona Registrar of ContractorsA.R.S. 32-1121 (Arizona Legislature)ROC license classificationsArizona Department of Health Services, Food SafetyMohave County, Food Code and Rule ChangesAZDHS Food Code changes overview (PDF)Arizona Attorney General, Legal Arizona Workers Act for employersA.R.S. 23-493.04 (Arizona Legislature)