Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Ohio |
|---|---|
| Statute citation | This state has 2 separate breach notification statutes: • Private Sector: Ohio Rev. Code § 1349.19 (Consumer Protection - Private Disclosure of |
| Individual notice timing | 45 days Ohio requires businesses and persons to notify affected individuals in the most expedient time |
| Attorney general notice | No Ohio does not require entities to notify the Attorney General or any state agency of data breaches; the |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Ohio 'breach of the security of the system' means unauthorized access to and acquisition of computerized data that compromises the security or confidentiality of personal information owned or licensed by a person and that causes, reasonably is believed to have caused, or reasonably is believed will cause a material risk of identity theft or other fraud to the person or property of a resident of this state. Good faith acquisition by an employee or agent for the purposes of the person is not a |