Introduction -

In recent years, Ohio has made unique and nationally-mirrored efforts toward advancing a goal of protecting the personal data of its residents. In addition to joining other U.S. states in 2005 by requiring companies to notify consumers of breaches of their personal data,[1] Ohio was the first state in the nation in 2018 to enact legislation – the Ohio Data Protection Act (“DPA”) providing businesses a specific legal incentive to maintain cybersecurity programs for the protection of personal data. A limited number of other jurisdictions, such as Utah, have since taken similar incentive based approaches to rewarding businesses that take specified action toward enhancing their cybersecurity postures and the protection of personal data.