ShareAndGoShareAndGo

Data breach notification

Ohio data breach notification law

Ohio's private-sector breach rule is Ohio Rev. Code § 1349.19, and it gives a business at most forty-five days.

Who must be told, and when

Disclosure to an affected resident is due in the most expedient time possible but not later than forty-five days following discovery or notification of the breach in the security of the system.

Section 1349.19 as served contains no requirement to notify the Attorney General or any other regulator. The Attorney General appears instead as the enforcer, who may investigate and bring a civil action. That split is worth noticing: in Ohio, the state's role begins after an incident, not with a filing.

Material risk decides it

The duty applies only if the access and acquisition by the unauthorized person causes, or reasonably is believed will cause, a material risk of identity theft or other fraud to the resident. That is the risk-of-harm judgment, written into the trigger rather than tacked on as an exception. The test looks forward as well as back: a risk that is reasonably believed will follow from the access and acquisition is enough. Without that risk, the section's duty to residents does not arise.

Data in scope

Personal information is a name linked to listed elements, when the data elements are not encrypted, redacted, or altered by any method or technology so that they are unreadable.

ElementNotes
Social Security numberListed as item (i).
Driver's license or state ID card numberListed as item (ii).
Account or card numberCovered with any required code or password.

Medical details, biometrics and online credentials do not appear in the text we checked for this page.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

A room's watermark setting is on by default and can be switched off room by room. Recipients confirm their email with a six-digit code and need no account. Groups see their folders only, and the chained log exports as CSV, which lets an Ohio team see exactly which of its own shared files were opened, by whom and on what date, within ShareAndGo.

Ohio questions

What is Ohio's deadline?
The most expedient time possible, but not later than forty-five days after discovery or notification of the breach.
Does Ohio require a filing with the Attorney General?
Not in § 1349.19 as served; the Attorney General enforces the section.
Is there a harm threshold?
Yes. The duty applies where there is, or is reasonably believed to be, a material risk of identity theft or other fraud.
Does redaction matter?
Yes. Elements that are encrypted, redacted or altered to be unreadable are outside the definition.

Source check

Checked against Ohio's published law on November 2, 2026. This is general information, not legal advice.

Explore

Breach notification laws by state

Breach rules for each state.

Compare data rooms

Data rooms compared.

ShareAndGo home

ShareAndGo home.