The Ohio Legislature recently passed an innovative cybersecurity law that provides an important opportunity for companies doing business in the state. The Ohio Data Protection Act (ODPA) (S.B. 220) grants an affirmative defense against data breach tort claims to those businesses that bring their cybersecurity frameworks up to an industry standard. Other states’ cybersecurity laws focus on requirements or penalties. The Ohio statute uses an affirmative defense to incentivize companies to...