# Ohio — US state data breach notification deadlines by state

For Ohio, statute citation is ORC § 1347.12; individual notice deadline is in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach in the security of the system; individual notice hard deadline (days) is 45; consumer reporting agency notice trigger (residents) is more than one thousand residents of this state involved in a single occurrence of a breach of the security of the system; encryption safe harbor is yes, recorded from its source on 2026-08-18.

- **State:** Ohio
- **Statute citation:** ORC § 1347.12
- **Individual notice deadline:** in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach in the security of the system _(verified: appears in the quote below)_
- **Individual notice hard deadline (days):** 45 _(our reading, not quoted from the source)_
- **Consumer reporting agency notice trigger (residents):** more than one thousand residents of this state involved in a single occurrence of a breach of the security of the system
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** CRITICAL SCOPE LIMIT: This section (ORC § 1347.12) applies ONLY to state agencies and agencies of political subdivisions — not to private businesses. The private-sector Ohio breach notification law is at ORC § 1349.19. No AG notification requirement is stated in this section (the AG may bring enforcement actions under ORC § 1349.191 and § 1349.192). CRA notice is required 'without unreasonable delay' when more than 1,000 residents are affected. _(our reading, not quoted from the source)_

## What the source says

> The state agency or agency of a political subdivision shall make the disclosure described in division (B)(1) of this section in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach in the security of the system, subject to the legitimate needs of law enforcement activities described in division (D) of this section and consistent with any measures necessary to determine the scope of the breach, including which residents' personal information was accessed and acquired, and to restore the reasonable integrity of the data system.

## Source

- https://codes.ohio.gov/ohio-revised-code/section-1347.12

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).