What is the data breach notification deadline in Ohio?

Ohio requires notice to affected individuals 45 calendar days from discovery (Ohio Rev. Code §§1349.19–192).

Do you have to notify the Ohio Attorney General of a data breach?

Ohio does not require attorney-general notice for private-entity breaches.

← All jurisdictions

OH · data breach notification

Ohio

med

Ohio Rev. Code §§1349.19–192

Individual deadline

45 days

Trigger standard

Risk of harm

AG / regulator

Not required

Notice to individuals	45 calendar days from discovery
Risk-of-harm standard	notice where breach reasonably believed to cause material risk of identity theft or fraud
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	Not required for private-entity breaches.
Credit reporting agencies	Notify CRAs above 1,000 residents.
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	No, enforcement by the state.

Notes

※ Ohio Data Protection Act (§1354): affirmative-defense safe harbor for conforming cybersecurity programs

Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Ohio breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →