Ohio’s New Cybersecurity Law: Creating a Data Breach Safe Harbor

Policymakers long have wrestled with how to enhance private-sector cybersecurity without imposing prescriptive one-size-fits-all requirements that undermine effective cyber risk management. With the passage of its Cybersecurity Safe Harbor Act (the “Act”) on August 3, 2018, Ohio has enacted legislation—the first of its kind—that is intended to use the promise of relief from legal liability to incentivize companies to adopt appropriate cyber protections. Specifically, the Act gives companies that take certain steps to create, maintain and comply with a written cyber program an affirmative defense to data breach claims sounding in tort (such as negligence) brought under the laws or in the courts of Ohio. It remains to be seen whether the Act will have a practical impact on companies’ approaches to cyber risk management or their liability exposure after a data breach. The Act nonetheless is important because it suggests a new approach to the regulation of cybersecurity practices and liability after a data breach


Mayer Brown partners Jeffrey P. Taft and Stephen Lilley, and counsel Kendall C. Burman report on the new guidance and highlight areas of interest in this Legal Update.

Related Content