In Arizona, the Attorney General's Office requires companies and organizations to notify the state within 45 days of a breach being discovered if it involves more than 1,000 Arizona residents.