Law / United States / 
Ohio
Security Breach Notification Act
In force since .
A breach notification rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Notify an affected Ohio resident of a security breach involving their personal information in the most expedient time possible and no later than 45 days after discovery or notification of the breach.
- Notify every nationwide consumer reporting agency without unreasonable delay if a single breach affects more than 1,000 Ohio residents.
- Do not rely on this statute to cover a breach of biometric, genetic, or student data alone. Ohio's personal information definition carries no such element.
These lines are LexLint's reading of the law's text. Also read by: Ohio Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ohioattorneygeneral.gov/Files/Publications-Files/Publications-for-Business/Data-Breach-Prevention-and-Response-Guide-for-Smal
- Guidance body
- Ohio Attorney General
- Open questions
- When does a person 'reasonably' believe that access and acquisition 'will cause a material risk of identity theft or other fraud' under Ohio Rev. Code section 1349.19(B)(1), given that the Attorney General's guide restates the test as when 'you believe that it will cause a material risk of identity theft or fraud'?
What it makes you log
Logging duty
The section requires a person that owns or licenses computerized data including personal information to disclose a breach to an affected Ohio resident within forty-five days, a custodian to notify the owner or licensee, and the person to notify nationwide consumer reporting agencies when more than one thousand residents are involved. Those are notices, not kept records. The section imposes no duty to keep a log or record of a breach, a notice or a decision, names no audit and gives no party a right to a record. A resident is defined by the principal mailing address in the person's own records, which fixes who is owed notice and creates no record duty. The Attorney General's enforcement authority sits in section 1349.192, which the row does not cite.
- Kind
- None
- As of
What this law does
Any person that owns or licenses computerized data including personal information must disclose a breach of the security of the system to an affected Ohio resident, in the most expedient time possible and no later than 45 days following discovery, subject to a law-enforcement delay.
Personal information is a name combined with a Social Security number, a driver's license or state identification card number, or a financial account, credit, or debit card number with an access code, and excludes information lawfully available to the general public from government records or widely distributed media; it carries no biometric, genetic, or student-data element.
Person has the meaning given in Ohio Rev. Code Sec. 1.59, an individual, corporation, business trust, estate, trust, partnership, or association with no government or governmental subdivision named, except that a business entity counts as a person only if it conducts business in Ohio, so this duty binds private actors, not the state or its political subdivisions.
A financial institution already subject to federal breach-notice requirements and a Health Insurance Portability and Accountability Act (HIPAA) covered entity are each exempt from this section. Once a single breach affects more than 1,000 Ohio residents, the person must also notify every nationwide consumer reporting agency without unreasonable delay.
The Attorney General has exclusive authority under Ohio Rev. Code Sec. 1349.192 to investigate and bring a civil action for a violation, with a civil penalty of up to $1,000 per day rising to $5,000 per day after 60 days and $10,000 per day after 90 days of an intentional or reckless violation, and the statute creates no private right of action.
Most recently amended by Senate Bill 126 (126th General Assembly), effective ; secondary reporting describes the original enactment as House Bill 104 (126th General Assembly), signed 2005, not independently confirmed against primary text.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .