1. Home
  2. State breach laws
  3. Ohio

Ohio data breach notification law

What Ohio requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Ohio Rev. Code § 1349.19 (private entities), § 1347.12 (state and local government agencies), and §§ 1349.191–1349.192 (enforcement).

45 days
Notification deadline
Not required
AG notification
No
Private right of action
Affirmative defense
Liability protection

What this means if you sell security services

Ohio gives 45 days to notify and, for intentional or reckless failures, escalates daily penalties from $1,000 to $5,000 to $10,000 the longer notice slips. More useful for sellers: under Ohio's Data Protection Act, an organization with a written cybersecurity program reasonably conforming to NIST, CIS Controls, ISO 27000, or a similar framework has an affirmative defense to negligence-type claims that poor security caused a breach. It doesn't change the duty to notify, but it is a state-law reason to build and document a security program, and an Ohio organization that just disclosed a breach knows exactly why that matters.

See recent Ohio breach filings →

Requirements in detail

Statute
Ohio Rev. Code § 1349.19 (private entities), § 1347.12 (state and local government agencies), and §§ 1349.191–1349.192 (enforcement)
Deadline to notify residents
In the most expedient time possible, but no later than 45 days after discovering or being notified of the breach. Notice may be delayed if law enforcement determines it would impede a criminal investigation or jeopardize homeland or national security.
Attorney General notification
No. Ohio law does not require notice to the Attorney General for private businesses or government agencies. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 Ohio residents must be notified in a single breach.
Penalties
The Attorney General has exclusive authority to sue. For each day an organization intentionally or recklessly fails to comply, courts may impose civil penalties of up to $1,000 per day for the first 60 days, up to $5,000 per day for days 61 through 90, and up to $10,000 per day after 90 days. The Attorney General may also seek a restraining order or injunction.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Ohio's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
Ohio's Data Protection Act (2018) gives businesses that maintain a written cybersecurity program reasonably conforming to a recognized framework (such as NIST, CIS Controls, or ISO 27000) an affirmative defense to tort claims alleging that a failure to implement reasonable security caused a breach. These protections limit lawsuits; they don't change the duty to notify. Ohio Rev. Code §§ 1354.01–1354.05

Ohio breach notification FAQ

What is the data breach notification deadline in Ohio?

In the most expedient time possible, but no later than 45 days after discovering or being notified of the breach. Notice may be delayed if law enforcement determines it would impede a criminal investigation or jeopardize homeland or national security. The governing law is Ohio Rev. Code § 1349.19 (private entities), § 1347.12 (state and local government agencies), and §§ 1349.191–1349.192 (enforcement).

Does Ohio require notifying the Attorney General of a data breach?

No. Ohio law does not require notice to the Attorney General for private businesses or government agencies. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 Ohio residents must be notified in a single breach.

What are the penalties for failing to report a data breach in Ohio?

The Attorney General has exclusive authority to sue. For each day an organization intentionally or recklessly fails to comply, courts may impose civil penalties of up to $1,000 per day for the first 60 days, up to $5,000 per day for days 61 through 90, and up to $10,000 per day after 90 days. The Attorney General may also seek a restraining order or injunction.

Can individuals sue over a data breach in Ohio?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Ohio?

Ohio's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Ohio limit breach lawsuits for companies with a cybersecurity program?

Ohio's Data Protection Act (2018) gives businesses that maintain a written cybersecurity program reasonably conforming to a recognized framework (such as NIST, CIS Controls, or ISO 27000) an affirmative defense to tort claims alleging that a failure to implement reasonable security caused a breach. These protections limit lawsuits; they don't change the duty to notify.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Ohio Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →