Ohio's Cybersecurity Safe Harbor, R.C. Chapter 1354: An Affirmative Defense in Tort, Not a Security Mandate

What Chapter 1354 Offers and What It Does Not Require

The chapter was enacted by Substitute Senate Bill 220 of the 132nd General Assembly, whose title describes a "legal safe harbor to covered entities that implement a specified cybersecurity program." The codified pages for sections 1354.02 to 1354.05 give the act's effective date as November 2, 2018. The same act also amended the Uniform Electronic Transactions Act to treat records and signatures secured through blockchain technology as electronic, and changed the casino law's definition of "key employee." The Revised Code places sections 1354.01 to 1354.05 under the chapter heading "Businesses Maintaining Recognized Cybersecurity Programs."

The words "Data Protection Act" do not appear in the act or the codified chapter. The Attorney General's office used it: a September 26, 2018 release stated that Attorney General Mike DeWine "led the effort to urge Ohio lawmakers to pass the Data Protection Act," that Governor John Kasich signed it in August, and that it was based on recommendations from the office's CyberOhio Advisory Board.

Section 3 of the act is uncodified and is the clearest statement of what the chapter is not. Subsection (A) describes the purpose as establishing "a legal safe harbor to be pled as an affirmative defense to a cause of action sounding in tort." Subsection (B) reads in part:

The act does not, and is not intended to, create a minimum cybersecurity standard that must be achieved, nor shall it be read to impose liability upon businesses that do not obtain or maintain practices in compliance with the act.

Sub. S.B. 220, 132nd General Assembly, Section 3(B)

Section 1354.04 adds that sections 1354.01 to 1354.05 "shall not be construed to provide a private right of action, including a class action, with respect to any act or practice regulated under those sections." Section 1354.05 is a severability clause. No section of the chapter assigns a regulator, requires a filing or sets a penalty.

Who Is a Covered Entity, and What Counts as a Breach

Under R.C. 1354.01, a covered entity is a business that "accesses, maintains, communicates, or processes personal information or restricted information in or through one or more systems, networks, or services located in or outside this state." Business is defined broadly, for-profit or not, including financial institutions chartered anywhere. The codified page shows a later amendment by House Bill 66 of the 132nd General Assembly, effective April 5, 2019, and the current definition names state institutions of higher education and private colleges among businesses.

Personal information carries the meaning in R.C. 1349.19, the breach notification statute. Restricted information is the chapter's own category: any other information about an individual that "can be used to distinguish or trace the individual's identity or that is linked or linkable to an individual," if unencrypted and unredacted and if its breach "is likely to result in a material risk of identity theft or other fraud." The chapter's definition of a data breach mirrors the breach statute's material risk test, but it speaks of risk "to person or property" without the breach statute's limitation to Ohio residents.

The Listed Frameworks

Section 1354.03 sets out three ways for a program to "reasonably conform" to an industry recognized framework.

• Division (A) lists the current version of any one or a combination of: the NIST framework for improving critical infrastructure cybersecurity; NIST special publication 800-171; NIST special publications 800-53 and 800-53a; the FedRAMP security assessment framework; the Center for Internet Security critical security controls; and the ISO/IEC 27000 family.
• Division (B) applies to an entity that is regulated by the state or federal government, or otherwise subject to the listed laws, and whose program reasonably conforms to "the entirety of the current version" of the HIPAA security requirements in 45 CFR Part 164 Subpart C, Title V of Gramm-Leach-Bliley, the Federal Information Security Modernization Act of 2014, or HITECH as set forth in 45 CFR part 162.
• Division (C) accepts the PCI data security standard only in combination with conformance to another framework listed in division (A).

Each route has an update window. When a listed framework is revised, a conforming program reasonably conforms to the revision "not later than one year after the publication date stated in the revision" for divisions (A) and (C), or one year after the amended framework's effective date for division (B). Division (D) runs the one-year period from the latest publication date when two or more combined frameworks are revised.

Scale and Scope Factors

Section 1354.02(A) offers two program types: one protecting personal information, and one protecting both personal information and restricted information. Division (B) requires the program to be designed to protect the security and confidentiality of the information, to protect against anticipated threats or hazards to its security or integrity, and to protect against unauthorized access and acquisition likely to cause a material risk of identity theft or fraud.

Division (C) states that a program's scale and scope "is appropriate if it is based on all of the following factors": the entity's size and complexity, the nature and scope of its activities, the sensitivity of the information, the cost and availability of tools to improve security, and the resources available to it. The text sets no size threshold and contains no exemption for small entities; the factors instead calibrate what a qualifying program looks like for a given entity.

The Affirmative Defense in a Tort Action

Division (D) is the operative grant. An entity that satisfies divisions (A)(1), (B) and (C) "is entitled to an affirmative defense to any cause of action sounding in tort that is brought under the laws of this state or in the courts of this state and that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information." Division (D)(2) extends the defense to breaches of restricted information where the entity maintains the broader program. The text addresses only tort claims; it does not mention contract claims, statutory claims or regulatory enforcement.

Because the provision is drafted as an affirmative defense, it is raised by the defendant in a pending suit, and the chapter is silent on how conformance is proved or who bears that burden. Section 1354.02 offers no certification, registration or advance determination.

What the Chapter Says It Does Not Create

One published decision applying the chapter was located. In Gales v. Ohio Lottery Comm., 2025-Ohio-5189, filed October 31, 2025, Judge David E. Cain of the Court of Claims of Ohio dismissed a proposed class action arising from a cybersecurity incident the Lottery Commission detected on December 24, 2023. The plaintiffs argued that a duty of care over cybersecurity decisions could be inferred from 1354.02(D)(1). The court "specifically reject[ed]" that argument, quoting 1354.04's bar on a private right of action, and found "no statutory language that suggests the General Assembly intended for a state agency to be liable for any such alleged wrongdoing." The tort claims were dismissed for lack of jurisdiction under Civ.R. 12(B)(1), and the contract and unjust enrichment claims under Civ.R. 12(B)(6).

The decision concerned a state agency rather than a business asserting the defense, so it says nothing about how a court evaluates a covered entity's program under 1354.02. No decision in which a covered entity pleaded and proved the defense was located for this post.

No Attorney General enforcement action is associated with the chapter, which gives the office no enforcement role. Ohio's breach notice duties are a separate statute with their own penalties (see the post on R.C. 1349.19).

Frequently Asked Questions