A Customer-Data Breach in Ohio, in Plain English
Last verified: October 2026
If customer data gets out, Ohio law may require you to tell the people affected — and there's a 45-day clock. Here's what the rules ask, what counts as a breach, and when to call a lawyer. Want a hand preparing? My number is (330) 200-8042.
Ohio's Breach Rules, at a Glance
If a crook gets into your systems and walks off with customer data, Ohio law (in ORC 1349.19) can require you to notify the people affected. It covers computerized personal information — a name plus a sensitive element like an SSN, driver's license number, or financial account details — when it isn't encrypted. You generally must notify affected Ohio residents as quickly as possible and no later than 45 days after discovery, and if more than 1,000 residents are affected you must also tell the credit bureaus. This guide explains it plainly and shows when to call a lawyer. There's a printable 29-page version up top. It's general information, not legal advice.
Common Questions
1 What is a data breach under Ohio law?
Generally, unauthorized access and acquisition of computerized personal information that causes, or is reasonably believed to cause, a material risk of identity theft or fraud. 'Personal information' means a name plus a sensitive element like an SSN, license number, or account number with its access code, when not encrypted.
2 How quickly do I have to notify people?
As quickly as possible, and no later than 45 days after you discover the breach. The clock can pause for a law-enforcement investigation or while you determine scope and restore systems — but those pauses are judgment calls for your lawyer.
3 Do I have to notify the credit bureaus?
Only if a single breach affects more than 1,000 Ohio residents. Then, in addition to notifying the residents, you must notify the nationwide consumer reporting agencies about the timing and content of your notices.
4 The stolen device was encrypted — is that a breach?
Often not a notifiable one. If the sensitive data was properly encrypted or redacted and stays unreadable, the law generally treats it as not exposed. Confirm with a lawyer — it's one more reason to encrypt every device with BitLocker or FileVault.
5 Who do I call first?
Your cyber-insurer's incident hotline and a breach lawyer — before you send any notice. They help decide whether it's notifiable, who must be told, and what the notice must say. Report the crime to the FBI at ic3.gov if advised.
6 Who enforces this, and what's the risk?
The Ohio Attorney General investigates and can bring a civil action for violations. Beyond the legal risk, failing to notify breaks customer trust. Prompt, honest handling is always the safer path.
Would You Rather I Just Help?
A breach is a scary thing to face, and the best time to get ready is before it ever happens. I'll help you find where your sensitive data lives, get it encrypted, line up your emergency contacts, and build a simple one-page plan — so a bad day becomes a checklist. $99 flat for a visit, 30-day come-back-free. I'm a tech helper, not a lawyer — for the legal calls I'll help you line up the right attorney.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).