Data Breach Notice to Residents and State Authorities in Ohio
At a glance
| Covered entity and service provider | Owner/licensee of computerized personal information: resident notice; custodian storing data for another person or government: expeditious owner notice (§ 1349.19(B)-(C)) |
|---|---|
| Breach and covered information | Unauthorized access AND acquisition of readable name plus SSN, ID number, or financial-account credentials, with material fraud risk; public information excluded (§ 1349.19(A)(1), (7), (B)) |
| Risk screen or notice exception | Material identity-theft/other-fraud risk is part of the breach and resident-notice tests; good-faith employee and compelled-access exclusions (§ 1349.19(A)(1), (B)) |
| Individuals who receive notice | Ohio residents, defined by principal mailing address in the holder's records, whose information was or reasonably is believed accessed and acquired (§ 1349.19(B)(1)) |
| Individual notice deadline and clock | Most expedient time possible; no later than 45 days after discovery or notification, subject to statutory investigation measures and law-enforcement delay (§ 1349.19(B)(2), (D)) |
| Regulator threshold and deadline | No routine AG breach filing in this private-entity notice section; AG may investigate alleged noncompliance (§ 1349.19(B)-(I)) |
| Consumer-reporting-agency notice | More than 1,000 Ohio residents in one breach: notify all nationwide consumer-reporting agencies of resident-notice timing, distribution, and content without unreasonable delay (§ 1349.19(G)) |
| Individual delivery and content | Writing, electronic notice if primary resident contact is electronic, or telephone; statute prescribes methods but no universal letter text (§ 1349.19(E)(1)-(3)) |
| Substitute notice conditions and channels | General: insufficient contacts, cost over $250,000, or class over 500,000, with email, site if maintained, and media reaching 75% of Ohio; separate ≤10-employee/$10,000 route (§ 1349.19(E)(4)-(5)) |
| Delays and alternate compliance | Law-enforcement finding that notice impedes an investigation or jeopardizes homeland/national security, until agency clearance; limited financial-institution and HIPAA-covered-entity exclusions (§ 1349.19(D), (F)) |
Requirements one by one
Breach and covered data
Under § 1349.19(A)(1), the incident must involve both unauthorized access and acquisition of computerized data and a material risk of identity theft or other fraud. Division (A)(7) limits covered information to a first and last name (or first initial and last name) linked to a readable Social Security number, driver's license or state ID number, or financial-account number with the access credential needed to use it. The definition excludes publicly available government records and specified widely distributed media. Good-faith employee acquisition and compelled acquisition under a warrant, subpoena, court order, or specified agency authority are excluded.
Resident and custodian notices
The owner or licensee must notify a person whose principal mailing address in its records is in Ohio and whose covered data was or reasonably is believed to have been accessed and acquired. Under § 1349.19(B)(2), notice must go in the “most expedient time possible” and no later than 45 days from discovery or notification of the breach. Scope and system-integrity work are allowed, subject to that outside period. A custodian holding another person's or a government entity's data instead tells that owner or entity expeditiously under § 1349.19(C); the section supplies no numbered day limit for that step.
Reporting agencies
Under § 1349.19(G), a single breach requiring disclosure to more than 1,000 Ohio residents also requires notice to every nationwide consumer-reporting agency. The agency notice describes the timing, distribution, and content of the resident notices, goes without unreasonable delay, and may not hold up those notices.
Delivery and substitute routes
Under § 1349.19(E), notice may be in writing, by telephone, or electronically where electronic contact is the sender's primary way to communicate with that resident. General substitute notice is available for insufficient contacts, direct-notice cost above $250,000, or more than 500,000 affected residents. It combines available email, a website posting if one exists, and major media whose combined audience reaches at least 75% of Ohio's population. A separate route covers a business with ten or fewer employees if direct notice would cost more than $10,000: it uses a quarter-page local newspaper ad weekly for three weeks, a website posting if maintained, and local major media.
What trips people up
No routine state filing appears in this private notice section. Section 1349.19(I) authorizes the Attorney General to investigate and sue for alleged noncompliance; it does not direct every breached entity to submit an incident report to that office. The consumer-reporting-agency threshold is a different route.
Sector exclusions need their own gate. Under § 1349.19(F), qualifying federally regulated financial institutions and affiliates are exempt, and HIPAA covered entities are outside this section. A business should identify the actual entity and law involved before applying either exclusion.
Police make the delay decision. Under § 1349.19(D), notice may be delayed only after a law-enforcement agency determines notice would impede an investigation or jeopardize homeland or national security; notice follows the agency's clearance decision.
Common questions
Must the resident letter include a statutory script? Section 1349.19(E) lists delivery methods but no universal letter wording. The facts sent should still accurately describe the incident and the recipient's affected data.
Can a contract waive the resident notice? No. Section 1349.19(B)(1) permits a pre-breach contract to govern disclosure only if it does not conflict with or waive the section's requirements.
Statutes and sources
- Ohio Rev. Code § 1349.19(A)-(I) — trigger, resident and custodian notices, deadlines, methods, substitute routes, exclusions, and reporting agencies. https://codes.ohio.gov/ohio-revised-code/section-1349.19 (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does Ohio law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Ohio law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace