Ohio Data Breach Notification Law

The Ohio data breach notification law covers a narrow set of data

Ohio Rev. Code § 1349.19 protects only a short list of data, yet backs it with fines that get steeper for every day a business stays out of compliance ¹².

Personal information under the Ohio law means a name plus one of three things: a Social Security number, a driver's license or state ID number, or a financial account or card number with the code needed to use it ¹. Health, biometric and login data are not on it. A stolen mailbox password with no account numbers inside may never trigger Ohio's statute, although customers from other states can still bring their own laws into play.

HIPAA covered entities fall outside the section, as do financial institutions examined under federal breach notice rules ¹. When a payroll or hosting firm loses records it keeps for a client, it must tell that client in an expeditious manner ¹.

Day 45, and who hears about it

Ohioans must hear in the most expedient time possible, and day 45 after discovery or outside notice is the latest ¹. Because the count starts at discovery, every week the forensic work takes comes out of that window.

No state agency, the Attorney General included, receives a breach report under this section ¹. The AG only enforces. Above 1,000 people to notify, the consumer reporting agencies get word as well ¹.

The lack of a state filing is not the same as a light law. Pennsylvania and Michigan apply their own rules to their residents, so an Ohio firm with customers on both sides of the line often works under three statutes at once. The chart of every state's breach rule puts them side by side.

When an Ohio breach does not require notice

A breach counts only if it causes, or is reasonably believed to have caused or to be likely to cause, a material risk of identity theft or other fraud to an Ohio resident ¹. No written record of a decision to skip letters is required; keep the forensic report that supports it all the same.

Data elements that are encrypted, redacted or otherwise altered so they are unreadable are exempt ¹. Nothing in the section deals with a stolen key. If the attacker walked off with both the files and the means to read them, assume the exemption is in doubt.

Penalties that grow by the day

Only the Attorney General may sue under the Ohio breach law ². For intentional or reckless noncompliance, the civil penalty is up to $1,000 for each day, rising to $5,000 per day after 60 days and $10,000 per day after 90 days ².

The math punishes stalling more than the breach. Miss day 45 and keep waiting, and each extra day costs more than the last. Customers get no lawsuit under this section ².

Ohio's safe harbor for a written security program

Ohio also rewards preparation with a legal benefit. Under the Ohio Data Protection Act, a business has an affirmative defense to tort claims after a data breach if it created, maintained and complied with a written cybersecurity program ³. The program must reasonably conform to a recognized framework, such as the NIST Cybersecurity Framework, NIST SP 800-171 or 800-53, the CIS Controls or ISO/IEC 27000 ³.

In a 20-person office, the program usually begins as a WISP tied to one framework and reviewed each year. A risk assessment against that framework shows the gaps to close first.

Working the Ohio 45-day clock

If the attacker is still active, an insured company reports the claim to its carrier, lodges an IC3 complaint so the FBI has it, and keeps hands off the affected machines until a forensic copy exists ⁴⁵⁷. Ohioans sent IC3 27,626 complaints in 2025, reporting roughly $421 million lost ⁶.

Next:

1. Write down the discovery date first, since the 45 days run from it, then have a containment team or the IT firm on your contract lock the attacker out.
2. If the policy names panel lawyers and forensic firms, use them; what carriers require covers the reasons.
3. Sort the people by home state and see whether the count crosses 1,000 for the bureaus.
4. Mail the Ohio letters no later than day 45.

For local IT support pricing, see our Columbus, Cleveland and Cincinnati pages.

Revised Code check for § 1349.19: October 13, 2026. This is background, not legal advice, and an Ohio lawyer can tell you what applies.