Ohio. Breach notification. Act
OH breach lawOhio data breach notification law (Ohio Rev. Code §§ 1349.19, 1349.191, 1349.192; § 1347.12 (agencies))
Partly verified
Medium confidence.Daily penalty schedule from recollection of § 1349.192; not stated on summary page.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Ohio residents to notify affected individuals after a security breach. Core timing rule: Individuals within 45 days of discovery. Covered data: name plus SSN, driver's licence/ID, financial account or card numbers with codes.
- Key themes
- Unique features
Ohio Data Protection Act gives an affirmative defence to tort claims for entities with a recognised cybersecurity framework (e.g. NIST, ISO 27001).
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Ohio requires a custodian acting for another entity to notify it in an expeditious manner. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 45 days of discovery; no AG notice; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $1,000/day for first 60 days, $5,000/day days 61-90, $10,000/day thereafter
§3Dates
- Key dates
- Adopted
- In force
- SB 126 (2007) exempted HIPAA covered entities; Data Protection Act (SB 220, 2018) adds cybersecurity safe harbour
§4Text and authority
- Text
- Authoritative text codes.ohio.gov
- Authority
- Ohio Attorney General
§5Where it applies
- Domestic law of
- Ohio
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Daily penalty schedule from recollection of § 1349.192; not stated on summary page.