Ohio breach notice under R.C. 1349.19: material-risk test, 45-day limit and credit bureau notice above 1,000 residents

Ohio requires notice to residents whose personal information was accessed and acquired when that causes or is reasonably believed to cause a material risk of identity theft or fraud, within 45 days of discovery, with nationwide credit bureau notice when more than 1,000 residents are involved.

Source facts

Ohio Revised Code 1349.19 requires a person that owns or licenses computerized personal information to disclose a breach to any Ohio resident whose information was, or is reasonably believed to have been, accessed and acquired, if that causes or is reasonably believed will cause a material risk of identity theft or other fraud. A resident is an individual whose principal mailing address in the person’s records is in Ohio.

Disclosure must be made in the most expedient time possible but not later than forty-five days after discovery or notification of the breach, subject to law-enforcement delays. Personal information means a first name or initial and last name linked to a Social Security number, driver’s license or state ID number, or a financial account or card number with any required code, when not encrypted, redacted or otherwise made unreadable.

A person that is custodian of or stores the data on behalf of another must notify that other person or governmental entity of a breach. If more than one thousand Ohio residents are involved in a single breach, the person must notify, without unreasonable delay, all nationwide consumer reporting agencies of the timing, distribution and content of the disclosure. The section does not apply to HIPAA covered entities, and the Attorney General may investigate and bring a civil action.

Applicability

Use this when an incident may involve Ohio residents. The page reviewed shows the section effective March 30, 2007; check the current text and any related Ohio statutes with counsel when an incident occurs.

DSE recommendation

DSE recommends recording Ohio’s 45-day deadline, material-risk test and 1,000-resident credit bureau trigger in the incident response plan for any organization holding Ohio residents’ data. Track residence by mailing address so affected counts can be produced, document the material-risk analysis for each incident, and require vendors that store your data to report breaches to you promptly.

Verification

In the annual incident exercise, start a 45-day clock at discovery, produce an Ohio resident count from sample data, and check that the plan names who decides the material-risk question and who sends credit bureau notice.

Official reference

Ohio Laws — Ohio Revised Code 1349.19, Private disclosure of security breach of computerized personal information data. Reviewed October 18, 2026.