← All US breach laws·OH

Ohio data breach notification law

Ohio's data breach notification requirements under Ohio Rev. Code §§1349.19, 1347.12 (state agencies). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Ohio Rev. Code §§1349.19
Enforcer
Ohio Attorney General
AG notification
Not required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
In the most expedient time possible and not later than 45 days following discovery or notification of the breach
Notify the state regulator
No general AG-notice requirement; the Data Protection Act (R.C. §1354) provides safe harbor against breach-related tort claims for businesses with a written security program meeting an accepted framework
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when there is material risk of identity theft or fraud to the resident
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Ohio law

First name/initial + last name with SSN, DL/state ID, financial account + access code

Penalties and enforcement

Civil penalty up to $1,000 per day for first 60 days late, then $5,000 per day, then $10,000 per day
Enforced by: Ohio Attorney General. Official regulator page →

Common pitfalls

⚠ Ohio's Data Protection Act safe harbor (R.C. §1354) is a major liability shield — implement a written program aligned to NIST/ISO/HIPAA BEFORE a breach

Frequently asked questions

How long do I have to notify Ohio residents after a data breach?
In the most expedient time possible and not later than 45 days following discovery or notification of the breach
Do I have to notify the Ohio Attorney General?
No general AG-notice requirement; the Data Protection Act (R.C. §1354) provides safe harbor against breach-related tort claims for businesses with a written security program meeting an accepted framework
Does Ohio require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Ohio's breach notification requirement?
Yes — Ohio has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Ohio residents sue me directly for a data breach?
No — Ohio's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Ohio law?
First name/initial + last name with SSN, DL/state ID, financial account + access code
What are the penalties for failing to comply with Ohio's breach notification law?
Civil penalty up to $1,000 per day for first 60 days late, then $5,000 per day, then $10,000 per day

Related state breach laws

North Carolina (NC)
N.C. Gen. Stat. §§75-60 to 75-65
North Dakota (ND)
N.D. Cent. Code §§51-30-01 to 51-30-07
Oklahoma (OK)
24 Okla. Stat. §§161 to 166
Oregon (OR)
Ore. Rev. Stat. §§646A.600 to 646A.628

Pre-empt the Ohio breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Ohio's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit