Get help →
Home›Obligations›United States›By state›Ohio

What a Ohio business has to have in writing

Ohio's signature contribution is the Data Protection Act, which does not order anyone to do anything but hands a business an affirmative defense in tort if it can show a written cybersecurity program that reasonably conforms to a named framework such as NIST 800-171, ISO 27000 or the CIS Controls.

Insurance licensees face a harder rule: a written information security program under Revised Code chapter 3965 plus an annual compliance certification filed with the Superintendent by February 15.

Employment mandates are light, though the Pay Stub Protection Act added a written earnings statement duty in April 2025 and the Employment Law Uniformity Act made an effective, well-publicised harassment policy the centerpiece of an employer's affirmative defense.

Ohio runs no OSHA State Plan for private employers; its PERRP program covers public employers only, and private workplaces answer to federal OSHA.

Ohio has a rule of its own in 8 of the 14 areas, listed below. We have not checked the other 6 yet. That is not the same as Ohio having no rule there, and you should not read it that way. It means we have not looked.

Headcount

Industry  General is always on

Share
Ad from the publisher
Policy  Acknowledgment  Proof
OhioHandbook 2026acknowledged by name
Ohio on Recordwith AllyMatter
Cover Ohio the Modern WayEvery policy Ohio makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Ohio on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
See how it works →Pricing →

Ohio rules for a 15–19 person general business

We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether Ohio has a rule of its own on top. The federal rules every employer carries follow the Ohio rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by
Breach of the security of the system - consumer notificationOhio Rev. Code § 1349.19 #Any person or business that owns or licenses computerised data including personal information about an Ohio residentDistribute + ack
Notice
Disclose the breach to affected Ohio residents in the most expedient time possible and no later than 45 days after discovery or notification, subject to law enforcement delay. If a single breach affects more than 1,000 Ohio residents, also tell the nationwide consumer reporting agencies about the timing, distribution and content of the consumer notice, without letting that step delay the consumer notice.
From the first employee
Ohio Attorney General (civil action for injunctive relief and civil penalties)
AuthorityOhio Laws - Revised Code § 1349.19Ohio Attorney General - Personal Information for ConsumersOhio Laws - Revised Code § 1349.192Report an error

Data Security Program 1A written safeguards program the state requires before anything goes wrong

LawProduceWhat it requiresTriggerEnforced by
Ohio Data Protection Act (cybersecurity safe harbour)Ohio Rev. Code ch. 1354 (SB 220, 132nd GA; effective November 2, 2018) #Any business that accesses, maintains, communicates or processes personal information or restricted information in or through a system. Compliance is voluntary; the payoff is a legal defense, not avoidance of a penalty.Write
Written program
Create, maintain and follow a written cybersecurity program with administrative, technical and physical safeguards that reasonably conforms to a recognized framework, and be able to show it. Named frameworks include NIST SP 800-171, NIST SP 800-53 and 800-53a, the NIST Cybersecurity Framework, FedRAMP, the CIS Critical Security Controls and the ISO/IEC 27000 family; regulated firms may instead conform to HIPAA, GLBA, FISMA or HITECH, and card-accepting firms combine PCI DSS with one of the listed frameworks. Scale the program to the size and complexity of the business, the sensitivity of the data and the resources available.
From the first employee
No regulator enforces it. The program is pleaded as an affirmative defense to a tort claim that inadequate security caused a data breach.
AuthorityOhio Laws - Revised Code chapter 1354Ohio Laws - Section 1354.02 (cybersecurity program)Ohio Laws - Section 1354.03 (recognized frameworks)Ohio Legislature - SB 220 (132nd GA)Report an error

Harassment Prevention 1A written policy, and in some states annual training, on harassment

LawProduceWhat it requiresTriggerEnforced by
Employment Law Uniformity Act - harassment affirmative defenseOhio Rev. Code § 4112.054 (HB 352, 133rd GA; effective April 15, 2021) #Employers facing a hostile work environment harassment claim based on a supervisor's conduct. Ohio does not require a harassment policy or training by statute.Write
Written policy
To use the statutory affirmative defense, the employer must be able to show it exercised reasonable care to prevent and promptly correct harassing behavior and that the employee unreasonably failed to use the channels offered. In practice that means an effective written harassment policy with a complaint procedure, evidence employees were educated about it, and records of prompt investigation and corrective action. The defense is unavailable where the supervisor's harassment produced a tangible employment action.
4+ employees
Ohio Civil Rights Commission; private civil action in the courts of common pleas
AuthorityOhio Laws - Revised Code § 4112.054Ohio Legislature - HB 352 (133rd GA)Ohio Laws - Revised Code § 4112.02Report an error

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by
Public Employment Risk Reduction Program (PERRP)Ohio Rev. Code ch. 4167 #State and local government employers only. Ohio has no OSHA-approved State Plan, so private-sector workplaces are covered by federal OSHA.Write
Written program
Public employers must comply with the Ohio Employment Risk Reduction Standards that PERRP adopts from federal OSHA, keep injury and illness records and file the annual 300AP summary, display the PERRP required posters, and report a workplace fatality within eight hours. Private employers meet federal OSHA recordkeeping, posting and reporting duties instead.
From the first employee
Ohio Bureau of Workers' Compensation, Public Employment Risk Reduction Program; federal OSHA for private employers
AuthorityOhio BWC - About PERRPOhio BWC - PERRP required postersOSHA - State Plans (Ohio is under federal OSHA)Report an error

Required Postings 2The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by
Ohio workplace posters (minimum wage and minor labour)Ohio Const. art. II, § 34a; Ohio Rev. Code ch. 4111 (minimum wage); Ohio Rev. Code ch. 4109 (minor labour) #Every Ohio employer; employers of minors must also post the minor labour law notice and the schedule of hoursPost
Posting
Display the current year's Ohio minimum wage poster from the Department of Commerce and, where minors are employed, the Ohio minor labour laws poster, in a place employees can see. Ohio's other mandatory notices come from separate agencies: the workers' compensation certificate from BWC, the unemployment notice from Job and Family Services, and the Civil Rights Commission's discrimination poster.
From the first employee
Ohio Department of Commerce, Division of Industrial Compliance, Wage and Hour Bureau
AuthorityOhio Department of Commerce - PostersOhio Department of Commerce - Minimum Wage PostersOhio Department of Commerce - Minor Labor Laws poster (PDF)Report an error
Fair employment practices noticeOhio Rev. Code § 4112.07 #Every employer subject to Ohio's laws against discrimination (four or more employees for most employment provisions)Post
Posting
Post the Ohio Civil Rights Commission's notice, which sets out excerpts of chapter 4112 and how to bring a charge, in a conspicuous place on the premises, or make it accessible to the public on the internet.
4+ employees
Ohio Civil Rights Commission
AuthorityOhio Laws - Revised Code § 4112.07Ohio Civil Rights Commission - EmploymentOhio Civil Rights Commission - Know Your Rights fair employment practices poster (PDF)Report an error

Other Written Policies 4Any other document the state makes an employer write or hand out

LawProduceWhat it requiresTriggerEnforced by
Pay Stub Protection ActOhio Rev. Code § 4113.14 (HB 106, 135th GA; effective April 9, 2025) #Every Ohio employerDistribute + ack
Notice
Give each employee a written or electronic statement, or access to one, on every regular payday showing total earnings for the pay period, itemised deductions such as taxes, benefits and garnishments, net pay after deductions, and hours worked where applicable. If an employee asks for a missing statement and the employer does not supply it within 10 business days, the employee may complain to the Division of Wage and Hour.
From the first employee
Ohio Department of Commerce, Division of Industrial Compliance, Wage and Hour Bureau
AuthorityOhio Department of Commerce - Paystub Protection Act information and complaintOhio Laws - Revised Code § 4113.14Ohio Legislature - HB 106 (135th GA)Report an error
Workers' compensation coverage (state fund)Ohio Rev. Code ch. 4123 #Any Ohio employer with one or more employees; Ohio is a monopolistic state-fund state, so coverage comes from BWC rather than a private carrierFile
Filing / record
Apply to the Bureau of Workers' Compensation for coverage (form U-3) before or as soon as employees start, pay premiums and file payroll true-ups on time, and print and display the certificate of coverage from the BWC policy portal so employees can see the employer is covered.
From the first employee
Ohio Bureau of Workers' Compensation
AuthorityOhio BWC - Getting coverageOhio BWC - Managing your coverageOhio BWC - Application for Ohio Workers' Compensation Coverage (U-3)Report an error
New hire and contractor reportingOhio Rev. Code § 3121.89 et seq. #Every Ohio employer, covering newly hired employees and independent contractors who live or work in OhioFile
Filing / record
Report every new hire and newly engaged contractor to the Ohio New Hire Reporting Center within 20 days of the start date, giving the worker's name, address and Social Security number along with the employer's name, address and federal identification number, and report changes in status.
From the first employee
Ohio Department of Job and Family Services, Office of Child Support
AuthorityOhio Department of Job and Family Services - Report New Hire and Changes in StatusODJFS - Ohio New Hire Reporting (PDF)Report an error
Minor work permits and minor labour rulesOhio Rev. Code ch. 4109 #Employers hiring workers under 18File
Filing / record
Complete the employer section of the minor work permit application with the student and guardian and have it filed with the student's school before the minor starts; agree wages with the minor in writing; keep the schedule of hours posted; and give a minor a 30-minute rest break after five consecutive hours of work.
From the first employee
Ohio Department of Commerce, Division of Industrial Compliance, Wage and Hour Bureau
AuthorityOhio Department of Commerce - Minor Work Permit ApplicationOhio Department of Commerce - Minor Labor Laws poster (PDF)Ohio Minor Work Permit portalReport an error

Because You Are in Food & Beverage 2Industry layer

LawProduceWhat it requiresTriggerEnforced by
Food service operation and retail food establishment licenseOhio Rev. Code ch. 3717; Ohio Admin. Code ch. 3717-1 (Ohio Uniform Food Safety Code) #Restaurants, mobile and temporary food service operations, vending machine locations and retail food establishmentsFile
Filing / record
Obtain a license from the local health district before operating, go through plan review where required, and operate to the Ohio Uniform Food Safety Code with routine inspections. The Department of Health's Food Safety Program sets the standards and approves the certification courses.
From the first employee
Ohio Department of Health, Food Safety Program; local health districts as licensors
AuthorityOhio Department of Health - Food Safety ProgramOhio Department of Health - Food Code Reference GuidesReport an error
Certification in food protection (person in charge and manager)Ohio Admin. Code 3701-21-25 #Licensed food service operations and retail food establishments: person-in-charge certification for operations first licensed after March 1, 2010, those implicated in an outbreak or cited for failing to maintain sanitary conditions, and high-risk mobiles first licensed after September 1, 2024; manager certification for all risk level three and four operationsCertify
Certification
Keep at least one person on site during all operating hours holding an Ohio person-in-charge certification in food protection, and for risk level three and four operations employ at least one person with authority to direct food activities who holds the Ohio manager certification, obtained by completing an ODH-approved course and passing the approved exam. Keep the certificates available for the licensor.
From the first employee
Ohio Department of Health; local health districts
AuthorityOhio Department of Health - Food Safety CertificationOhio Department of Health - Application for Ohio Manager Certification in Food ProtectionOhio Department of Health - Ohio PIC Certification ProvidersReport an error

Because You Are in Financial & Tax 1Industry layer

LawProduceWhat it requiresTriggerEnforced by
Insurance data security lawOhio Rev. Code ch. 3965 #Insurance licensees authorized, registered or licensed under Ohio insurance law; insurers domiciled in Ohio file the annual certification. Section 3965.07 sets out exemptions from the certification duty for smaller licensees.Certify
Certification
Build and maintain a comprehensive written information security program based on a risk assessment, sized to the licensee's complexity, activities, use of third-party service providers and the sensitivity of the nonpublic information held, covering administrative, technical and physical safeguards. Investigate and report cybersecurity events to the Superintendent, and file a written statement by February 15 each year certifying compliance, unless a section 3965.07 exemption applies (in which case file the notice of exemption).
From the first employee
Ohio Department of Insurance, Superintendent of Insurance
AuthorityOhio Department of Insurance - Information SecurityOhio Laws - Revised Code § 3965.02 (information security program)Ohio Laws - Revised Code chapter 3965Report an error

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Your business type, with Ohio on top

Small businessFederal + industry, with Ohio on topConstruction contractorsFederal + industry, with Ohio on topHealthcare practicesFederal + industry, with Ohio on topFood and beverage businessesFederal + industry, with Ohio on topTax and accounting firmsFederal + industry, with Ohio on topRegistered investment advisersFederal + industry, with Ohio on topInsurance agenciesFederal + industry, with Ohio on topRetail and e-commerceFederal + industry, with Ohio on topTrucking and logistics carriersFederal + industry, with Ohio on topNonprofitsFederal + industry, with Ohio on topFederal contractorsFederal + industry, with Ohio on top

For another state

Alabama12Alaska12Arizona11Arkansas14California24Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine15Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Advertise Here

Sources

Ohio Laws - Revised Code chapter 1354Ohio Laws - Section 1354.02 (cybersecurity program)Ohio Laws - Section 1354.03 (recognized frameworks)Ohio Legislature - SB 220 (132nd GA)Ohio Laws - Revised Code § 1349.19Ohio Attorney General - Personal Information for ConsumersOhio Laws - Revised Code § 1349.192Ohio Department of Insurance - Information SecurityOhio Laws - Revised Code § 3965.02 (information security program)Ohio Laws - Revised Code chapter 3965Ohio Laws - Revised Code § 4112.054Ohio Legislature - HB 352 (133rd GA)Ohio Laws - Revised Code § 4112.02Ohio Department of Commerce - Paystub Protection Act information and complaintOhio Laws - Revised Code § 4113.14Ohio Legislature - HB 106 (135th GA)Ohio Department of Commerce - PostersOhio Department of Commerce - Minimum Wage PostersOhio Department of Commerce - Minor Labor Laws poster (PDF)Ohio BWC - About PERRPOhio BWC - PERRP required postersOSHA - State Plans (Ohio is under federal OSHA)Ohio Department of Health - Food Safety ProgramOhio Department of Health - Food Code Reference GuidesOhio Department of Health - Food Safety CertificationOhio Department of Health - Application for Ohio Manager Certification in Food ProtectionOhio Department of Health - Ohio PIC Certification ProvidersOhio BWC - Getting coverageOhio BWC - Managing your coverageOhio BWC - Application for Ohio Workers' Compensation Coverage (U-3)Ohio Department of Job and Family Services - Report New Hire and Changes in StatusODJFS - Ohio New Hire Reporting (PDF)Ohio Department of Commerce - Minor Work Permit ApplicationOhio Minor Work Permit portalOhio Laws - Revised Code § 4112.07Ohio Civil Rights Commission - EmploymentOhio Civil Rights Commission - Know Your Rights fair employment practices poster (PDF)

About this data

Pages on this site are compiled by AllyMatter and checked against one or more sources, two or more where available. Each record shows its stage and date. Nothing here is legal, audit or tax advice, and policyandcompliance.com and AllyMatter, Inc. accept no responsibility for errors or for decisions made on it. Read the source, then decide.
How we compile and verify →

Think something is wrong?

[email protected]
Tell us the page and what you found. We check it against the source and fix it.

Want to advertise here?

[email protected]
Consultant listings, tool listings, press releases and the primary spot, flat fee, paid in advance. Prices and rules · Design examples · Press releases.