State Breach Law

Ohio Data Breach Notification Law

O.R.C. § 1349.19, § 1354.01 et seq. • Effective 2006-02-17

Ohio is unique: if you implement a strong cybersecurity program (like NIST or CIS Controls), you get legal protection if you're sued over a breach. Notification must happen "as fast as possible." Ohio actually rewards good security practices instead of just punishing breaches.

Notification deadline: Most expedient time possible, not to exceed 45 days

Enforcement: Ohio Attorney General

Overview

Ohio requires breach notification "in the most expedient time possible" and offers businesses an affirmative defense against data breach lawsuits if they implement qualifying cybersecurity programs - making Ohio unique in incentivizing proactive security.

Who Must Be Notified

  • • Affected Ohio residents
  • • Ohio Attorney General (recommended but not required)

Covered Data Types

Social Security number, Driver's license number, State ID number, Financial account number with access code, Credit/debit card number

Notification Requirements

  • • Written, telephonic, or electronic notice
  • • Most expedient time possible, not exceeding 45 days
  • • Include description of breach and information types
  • • Contact information for business
  • • Toll-free numbers for credit bureaus
  • • Substitute notice allowed if cost exceeds $250,000 or 500,000+ affected

Is your business exposed?

Exemptions

  • • Encrypted data (if key not compromised)
  • • Good faith acquisition by employee
  • • Entities in compliance with GLBA, HIPAA

Penalties

Violations treated as unfair or deceptive practices. AG can seek injunctions and penalties. HOWEVER: businesses with qualifying cybersecurity programs have affirmative defense against breach lawsuits.

If You Experience a Breach

  1. 1.

    Implement a qualifying cybersecurity framework for liability protection

    NIST CSF or CIS Controls

  2. 2.

    Document your cybersecurity program alignment with standards

  3. 3.

    Be prepared to meet 45-day notification deadline

  4. 4.

    Create notification templates

  5. 5.

    Know how to contact OH Attorney General

    OH AG Consumer Protection →

  6. 6.

    Review Ohio Data Protection Act safe harbor requirements

Official Source

https://www.ohioattorneygeneral.gov/Individuals-and-Families/Consumers

Other State Breach Laws

New York, Texas, Florida

Is your business exposed?

Check if your company data is circulating on the dark web

Free scan • No credit card required

Privacy PolicyYour Privacy Choices