The Letter About Your Information
ORC 1349.19 — forty five days from discovery, and the credit bureaus at a thousand
When a business loses your information, the letter that arrives weeks later is not a courtesy. Ohio requires it, sets a clock on it, and adds a second obligation once a breach is large enough that the credit bureaus need to know.
Who handles this in Ohio: Ohio Attorney General, Consumer Protection Section; and legal aid programs, lawyer referral and the state offices, listed in the Ohio directory.
The most expedient time possible, and not later than forty five days. A person who owns or licenses computerized data that includes personal information makes the disclosure in the most expedient time possible but not later than forty five days following discovery or notification of the breach in the security of the system, subject to the legitimate needs of law enforcement and to measures necessary to determine the scope of the breach and restore the integrity of the system.
A resident of this state, for the purpose of the section, is an individual whose principal mailing address as reflected in the records of the person is in this state. The duty runs to the address on the file rather than to where somebody happens to be.
Past a thousand residents, the credit bureaus are told as well. Where a person discovers circumstances that require disclosure to more than one thousand residents of this state involved in a single occurrence of a breach, the person also notifies, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution and content of the disclosure.
| The obligation | The section's terms |
|---|---|
| The obligationNotify affected residents | The section's termsIn the most expedient time possible, not later than forty five days after discovery |
| The obligationWhat can lawfully delay it | The section's termsLegitimate law enforcement needs, and determining the scope and restoring the system |
| The obligationNotify the credit bureaus | The section's termsWhere more than one thousand residents are affected in a single occurrence |
| The obligationWho counts as a resident | The section's termsPrincipal mailing address in the person's records is in Ohio |
What counts as personal information under the section, the forms a notice may take, the separate rules for state agencies and for entities regulated under federal law, and what a person may do about a breach once notified are not on this page. Whether a particular delay was permitted, and whether a particular incident was a breach the section reaches, are questions for a licensed Ohio attorney; the attorney general's office takes complaints about notices that did not arrive.
Sources for this section (1)
- ORC 1349.19 — Disclosure of a security breach of computerized personal information
Legal information, not legal advice. Verified as of September 2026. Applying it to a particular situation is the work of a licensed Ohio attorney.