[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is the Ohio Data Protection Act (Senate Bill 220)?](/blog/ohio-senate-bill-220) Publish date January 16, 2025 {x} minute read # What is the Ohio Data Protection Act (Senate Bill 220)? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Nicholas Sollitto](/team/nicholas-sollitto) Senior Cybersecurity Writer Nicholas's cybersecurity writing has been featured in G2. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The Ohio state government enacted Senate Bill 220, commonly known as the Ohio Data Protection Act, in November 2018. The act was the first incentive-based law introduced in the United States to protect organizations that achieve a “higher level of cybersecurity.” In particular, the law offers additional protections (legal safe harbor) to organizations that maintain a robust[ cybersecurity](https://www.upguard.com/blog/cybersecurity-important) program that aligns with one of eight industry-trusted security frameworks. [Learn how UpGuard can empower your organization to strengthen its cybersecurity program>](https://www.upguard.com/product/breachsight) ## What Compliance Standards Does Senate Bill 220 Accept? The Ohio Data Protection Act provides legal safe harbor to businesses that substantially comply with one of eight industry-recognized cybersecurity frameworks. Covered entities demonstrating compliance are entitled to an affirmative defense against tort claims (lawsuits to claim compensation for damages) related to a[ data breach](https://www.upguard.com/blog/data-breach) or alleged failure to adopt best practices into their security program. An affirmative defense is a specialized legal defense that allows the defendant of a case to shift the burden of proof. Prosecutors are not required to disprove the validity of the affirmative defense; instead, the defendant must prove the defense applies to the case. When the defendant raises an affirmative defense successfully, they can negate criminal or civil liability.  To be eligible for legal safe harbor, organizations must create, maintain, and conform to a written cybersecurity program that meets the[ data security standards](https://www.upguard.com/blog/data-security) of one of the following industry frameworks: * [Center for Internet Security’s Critical Security Controls (CIS CSC)](https://www.upguard.com/blog/cis-controls), * [Federal Risk and Authorization Management Program (FedRAMP)](https://www.upguard.com/blog/fedramp), * [International Organization for Standardization/International Electrotechnical Commission’s 27000 Family - Information Security Management Systems](https://www.upguard.com/blog/iso-third-party-risk-management-requirements), * [National Institute of Standards and Technology (NIST) Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework), * [Federal Information Security Modernization Act of 2014 (FISMA)](https://www.upguard.com/blog/fisma), * [Health Insurance Portability and Accountability Act (HIPAA)](https://www.upguard.com/blog/hipaa-privacy-rule), * [Health Information Technology for Economic and Clinical Health Act (HITECH Act)](https://www.upguard.com/blog/hitech-compliance), or * Title V of the[ Gramm-Leach-Bliley Act (GLBA)](https://www.upguard.com/blog/glba) The Ohio Data Protection Act also protects organizations that meet [Payment Card Industry Data Security Standards (PCI-DSS)](https://www.upguard.com/blog/pci-compliance) and other listed framework standards. *Note:* Senate Bill 220 explicitly states that the law does not intend to create a minimum cybersecurity standard. Organizations should not read the law as an imposition of liability upon their businesses. Multiple sections of the bill clarify that organizations may need to fortify the accepted security frameworks with additional protections to protect [sensitive data](https://www.upguard.com/blog/sensitive-data) as new security risks arise. All companies should develop a cybersecurity program appropriate to the size, scale, and nature of their operation and the sensitivity of the information they collect, store, or otherwise process. ### “Covered Entities” The Ohio Data Protection Act applies broadly to any Ohio business, organization, or collection of entities that process personal information or restricted information. ### “Personal Information” Ohio Senate Bill 220 defines[ personal information](https://www.upguard.com/blog/personally-identifiable-information-pii) as any information that includes an individual’s name (first name or first initial and last name) in combination with any of the following data elements: * Social Security number * Driver’s license number * State identification card number * Financial account number or credit or debit card number (in combination with the access pin or security code that would allow access to the individual’s banking account) The law’s definition excludes publicly available information that is legally obtained from state or federal government records or circulated media sources, such as: * News, editorial, or advertising statements published in a newspaper or magazine or broadcasted over the radio or television - Information gathered by a news reporter or correspondent - Association, charitable, and non-profit publications distributed to members - Any media that meets similar standards to the types listed above ### “Restricted Information” Ohio law defines restricted information as any[ unencrypted information](https://www.upguard.com/blog/encryption) that an individual or organization can reasonably use to distinguish an individual’s identity. ## What are the Limitations of the Safe Harbor Policy? The legal safe harbor protections granted by Senate Bill 220 do not provide covered organizations with blanket immunity. The protections afforded by the bill’s safe harbor provisions are limited to tort claims related to a[ data breach](https://www.upguard.com/blog/data-breach) or failure to maintain[ industry best practices](https://www.upguard.com/blog/third-party-risk-assessment-best-practices). Senate Bill 220 does not protect organizations from contract-based disputes that result from a contract with a third-party processor or its customers. This limitation includes contracts between data controllers and processors.  [Learn how UpGuard helps organizations manage vendor relationships>](https://www.upguard.com/product/vendorrisk) In the event of a lawsuit, a covered organization would need to prove its cybersecurity program met the standards of the law before it achieved safe harbor privileges. ## Incentive Benefits vs. Enforcement The Ohio Data Protection Act differs from most other privacy laws simply because it offers incentive-based benefits to improve the [security posture](https://www.upguard.com/blog/security-posture) of local businesses rather than enforcing regulatory punishments. Most other privacy laws, such as the[ California Consumer Privacy Act (CCPA)](https://www.upguard.com/blog/what-is-the-ccpa) or[ Virginia Consumer Data Protection Act (VCDPA)](https://upguard.com/blog/vcdpa), are enforced by a private right of action or by the state attorney general. On July 7, 2021, the Ohio government introduced House Bill 376, the Ohio Personal Privacy Act. This bill has yet to be passed by the Senate or House of Representatives but would enforce regulations similar to those presented by California, Virginia, and other state privacy laws. If Ohio passes House Bill 376, it will be one of the only states in the nation to offer incentive-based benefits and impose regulations on the security measures taken by local businesses. This combination of legislation could pose interesting implications for Ohio businesses. ## Data Privacy Laws Around the United States After the European Union passed its[ General Data Protection Regulation (GDPR)](https://www.upguard.com/blog/how-to-be-gdpr-compliant) in 2018, various U.S. states followed suit. The following U.S. states have passed comprehensive privacy protection legislation: * [California (CCPA)](https://www.upguard.com/blog/what-is-the-ccpa) * [Colorado (CPA)](https://www.upguard.com/blog/colorado-privacy-act) * Connecticut (CTDPA) * Indiana (INCDPA) * Iowa (ICDPA) * Montana (MTCDPA) * Tennessee (TIPA) * [Texas (TDPSA)](https://www.upguard.com/blog/texas-data-privacy) * Utah (UCPA) * [Virginia (CDPA)](https://upguard.com/blog/vcdpa) In addition to these comprehensive laws passed by U.S. states, several other states have passed critical security regulations and privacy laws of their own: * [California IoT Security Law (SB-237)](https://www.upguard.com/blog/california-iot-security-law) * [Texas Risk and Authorization Management Program (TX-RAMP)](https://www.upguard.com/blog/tx-ramp) * [Washington’s My Health My Data (MHMD) Act](https://www.upguard.com/blog/mhmd-act) * [Nevada Privacy Law (603A)](https://www.upguard.com/blog/nevada-privacy-law) ## How Can UpGuard Help? UpGuard’s cybersecurity products help businesses identify data risks and[ remediate vulnerabilities](https://www.upguard.com/blog/vulnerability-remediation) across their internal and external[ attack surfaces](https://www.upguard.com/blog/best-attack-surface-management-software-solutions). [UpGuard Breach Risk](https://www.upguard.com/product/breachsight) empowers organizations to manage their[ security posture](https://www.upguard.com/blog/security-posture) with confidence. Using the product, organizations can monitor their[ attack surface](https://www.upguard.com/blog/attack-surface) 24/7,[ prioritize vulnerabilities](https://www.upguard.com/blog/vulnerability-assessment), and protect their overall reputation. [UpGuard Vendor Risk](https://www.upguard.com/product/vendorrisk) allows organizations to streamline their vendor risk management program through the use of[ automated assessment workflows](https://www.upguard.com/product/risk-assessments), customizable security questionnaires, and real-time notifications in[ one centralized dashboard](https://www.upguard.com/product/reporting). eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)