Ohio
For Ohio, statute citation is ORC § 1347.12; individual notice deadline is in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach in the security of the system; individual notice hard deadline (days) is 45; consumer reporting agency notice trigger (residents) is more than one thousand residents of this state involved in a single occurrence of a breach of the security of the system; encryption safe harbor is yes, recorded from its source on 2026-08-18.
- State
- Ohio
- Statute citation
- ORC § 1347.12
- Individual notice deadline
- in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach in the security of the system verified
- Individual notice hard deadline (days)
- 45 our reading
- Consumer reporting agency notice trigger (residents)
- more than one thousand residents of this state involved in a single occurrence of a breach of the security of the system
- Encryption safe harbor
- yes our reading
- Notes
- CRITICAL SCOPE LIMIT: This section (ORC § 1347.12) applies ONLY to state agencies and agencies of political subdivisions — not to private businesses. The private-sector Ohio breach notification law is at ORC § 1349.19. No AG notification requirement is stated in this section (the AG may bring enforcement actions under ORC § 1349.191 and § 1349.192). CRA notice is required 'without unreasonable delay' when more than 1,000 residents are affected. our reading
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
The state agency or agency of a political subdivision shall make the disclosure described in division (B)(1) of this section in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach in the security of the system, subject to the legitimate needs of law enforcement activities described in division (D) of this section and consistent with any measures necessary to determine the scope of the breach, including which residents' personal information was accessed and acquired, and to restore the reasonable integrity of the data system.
— codes.ohio.gov, retrieved 2026-08-18
Source
- codes.ohio.govhttps://codes.ohio.gov/ohio-revised-code/section-1347.12