Policy+ComplianceP+C
Get help →
Home›Obligations›United States›By state›Ohio

Obligations  United States  Ohio

What a Ohio business has to have in writing

Ohio's signature contribution is the Data Protection Act, which does not order anyone to do anything but hands a business an affirmative defence in tort if it can show a written cybersecurity program that reasonably conforms to a named framework such as NIST 800-171, ISO 27000 or the CIS Controls.

Insurance licensees face a harder rule: a written information security program under Revised Code chapter 3965 plus an annual compliance certification filed with the Superintendent by February 15.

Employment mandates are light, though the Pay Stub Protection Act added a written earnings statement duty in April 2025 and the Employment Law Uniformity Act made an effective, well-publicised harassment policy the centrepiece of an employer's affirmative defence.

Ohio runs no OSHA State Plan for private employers; its PERRP program covers public employers only, and private workplaces answer to federal OSHA.

Headcount

Industry  General is always on

Share
Sponsored
Policy  Acknowledgment  Proof
OhioHandbook 2026acknowledged by name
Ohio on Recordwith AllyMatter
Cover Ohio the Modern WayEvery policy Ohio makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Ohio on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
See how it works →Pricing →

What applies

Ohio rules for a 15–19 person general business

State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by
Breach of the security of the system - consumer notificationAI-compiledOhio Rev. Code § 1349.19Any person or business that owns or licenses computerised data including personal information about an Ohio residentDistribute + ack
Notice
Disclose the breach to affected Ohio residents in the most expedient time possible and no later than 45 days after discovery or notification, subject to law enforcement delay. If a single breach affects more than 1,000 Ohio residents, also tell the nationwide consumer reporting agencies about the timing, distribution and content of the consumer notice, without letting that step delay the consumer notice.
From the first employee
Ohio Attorney General (civil action for injunctive relief and civil penalties)
AuthorityOhio Laws - Revised Code § 1349.19Ohio Attorney General - Personal Information for ConsumersOhio Laws - Revised Code § 1349.192

Data Security Program 1A written safeguards program the state requires before anything goes wrong

LawProduceWhat it requiresTriggerEnforced by
Ohio Data Protection Act (cybersecurity safe harbour)AI-compiledOhio Rev. Code ch. 1354 (SB 220, 132nd GA; effective November 2, 2018)Any business that accesses, maintains, communicates or processes personal information or restricted information in or through a system. Compliance is voluntary; the payoff is a legal defence, not avoidance of a penalty.Write
Written program
Create, maintain and follow a written cybersecurity program with administrative, technical and physical safeguards that reasonably conforms to a recognised framework, and be able to show it. Named frameworks include NIST SP 800-171, NIST SP 800-53 and 800-53a, the NIST Cybersecurity Framework, FedRAMP, the CIS Critical Security Controls and the ISO/IEC 27000 family; regulated firms may instead conform to HIPAA, GLBA, FISMA or HITECH, and card-accepting firms combine PCI DSS with one of the listed frameworks. Scale the program to the size and complexity of the business, the sensitivity of the data and the resources available.
From the first employee
No regulator enforces it. The program is pleaded as an affirmative defence to a tort claim that inadequate security caused a data breach.
AuthorityOhio Laws - Revised Code chapter 1354Ohio Laws - Section 1354.02 (cybersecurity program)Ohio Laws - Section 1354.03 (recognised frameworks)Ohio Legislature - SB 220 (132nd GA)

Harassment Prevention 1A written policy, and in some states annual training, on harassment

LawProduceWhat it requiresTriggerEnforced by
Employment Law Uniformity Act - harassment affirmative defenceAI-compiledOhio Rev. Code § 4112.054 (HB 352, 133rd GA; effective April 15, 2021)Employers facing a hostile work environment harassment claim based on a supervisor's conduct. Ohio does not require a harassment policy or training by statute.Write
Written policy
To use the statutory affirmative defence, the employer must be able to show it exercised reasonable care to prevent and promptly correct harassing behaviour and that the employee unreasonably failed to use the channels offered. In practice that means an effective written harassment policy with a complaint procedure, evidence employees were educated about it, and records of prompt investigation and corrective action. The defence is unavailable where the supervisor's harassment produced a tangible employment action.
4+ employees
Ohio Civil Rights Commission; private civil action in the courts of common pleas
AuthorityOhio Laws - Revised Code § 4112.054Ohio Legislature - HB 352 (133rd GA)Ohio Laws - Revised Code § 4112.02

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by
Public Employment Risk Reduction Program (PERRP)AI-compiledOhio Rev. Code ch. 4167State and local government employers only. Ohio has no OSHA-approved State Plan, so private-sector workplaces are covered by federal OSHA.Write
Written program
Public employers must comply with the Ohio Employment Risk Reduction Standards that PERRP adopts from federal OSHA, keep injury and illness records and file the annual 300AP summary, display the PERRP required posters, and report a workplace fatality within eight hours. Private employers meet federal OSHA recordkeeping, posting and reporting duties instead.
From the first employee
Ohio Bureau of Workers' Compensation, Public Employment Risk Reduction Program; federal OSHA for private employers
AuthorityOhio BWC - About PERRPOhio BWC - PERRP required postersOSHA - State Plans (Ohio is under federal OSHA)

Insurance Data Security 1The written security program insurance licensees must certify

LawProduceWhat it requiresTriggerEnforced by
Insurance data security lawAI-compiledOhio Rev. Code ch. 3965Insurance licensees authorised, registered or licensed under Ohio insurance law; insurers domiciled in Ohio file the annual certification. Section 3965.07 sets out exemptions from the certification duty for smaller licensees.Certify
Certification
Build and maintain a comprehensive written information security program based on a risk assessment, sized to the licensee's complexity, activities, use of third-party service providers and the sensitivity of the nonpublic information held, covering administrative, technical and physical safeguards. Investigate and report cybersecurity events to the Superintendent, and file a written statement by February 15 each year certifying compliance, unless a section 3965.07 exemption applies (in which case file the notice of exemption).
From the first employee
Ohio Department of Insurance, Superintendent of Insurance
AuthorityOhio Department of Insurance - Information SecurityOhio Laws - Revised Code § 3965.02 (information security program)Ohio Laws - Revised Code chapter 3965

Required Postings 2The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by
Ohio workplace posters (minimum wage and minor labour)AI-compiledOhio Const. art. II, § 34a; Ohio Rev. Code ch. 4111 (minimum wage); Ohio Rev. Code ch. 4109 (minor labour)Every Ohio employer; employers of minors must also post the minor labour law notice and the schedule of hoursPost
Posting
Display the current year's Ohio minimum wage poster from the Department of Commerce and, where minors are employed, the Ohio minor labour laws poster, in a place employees can see. Ohio's other mandatory notices come from separate agencies: the workers' compensation certificate from BWC, the unemployment notice from Job and Family Services, and the Civil Rights Commission's discrimination poster.
From the first employee
Ohio Department of Commerce, Division of Industrial Compliance, Wage and Hour Bureau
AuthorityOhio Department of Commerce - PostersOhio Department of Commerce - Minimum Wage PostersOhio Department of Commerce - Minor Labor Laws poster (PDF)
Fair employment practices noticeAI-compiledOhio Rev. Code § 4112.07Every employer subject to Ohio's laws against discrimination (four or more employees for most employment provisions)Post
Posting
Post the Ohio Civil Rights Commission's notice, which sets out excerpts of chapter 4112 and how to bring a charge, in a conspicuous place on the premises, or make it accessible to the public on the internet.
4+ employees
Ohio Civil Rights Commission
AuthorityOhio Laws - Revised Code § 4112.07Ohio Civil Rights Commission - EmploymentOhio Civil Rights Commission - Know Your Rights fair employment practices poster (PDF)

Licensing and Certifications 2Registrations, licences and certifications a business or its staff must hold

LawProduceWhat it requiresTriggerEnforced by
Food service operation and retail food establishment licenceAI-compiledOhio Rev. Code ch. 3717; Ohio Admin. Code ch. 3717-1 (Ohio Uniform Food Safety Code)Restaurants, mobile and temporary food service operations, vending machine locations and retail food establishmentsFile
Filing / record
Obtain a licence from the local health district before operating, go through plan review where required, and operate to the Ohio Uniform Food Safety Code with routine inspections. The Department of Health's Food Safety Program sets the standards and approves the certification courses.
From the first employee
Ohio Department of Health, Food Safety Program; local health districts as licensors
AuthorityOhio Department of Health - Food Safety ProgramOhio Department of Health - Food Code Reference Guides
Certification in food protection (person in charge and manager)AI-compiledOhio Admin. Code 3701-21-25Licensed food service operations and retail food establishments: person-in-charge certification for operations first licensed after March 1, 2010, those implicated in an outbreak or cited for failing to maintain sanitary conditions, and high-risk mobiles first licensed after September 1, 2024; manager certification for all risk level three and four operationsCertify
Certification
Keep at least one person on site during all operating hours holding an Ohio person-in-charge certification in food protection, and for risk level three and four operations employ at least one person with authority to direct food activities who holds the Ohio manager certification, obtained by completing an ODH-approved course and passing the approved exam. Keep the certificates available for the licensor.
From the first employee
Ohio Department of Health; local health districts
AuthorityOhio Department of Health - Food Safety CertificationOhio Department of Health - Application for Ohio Manager Certification in Food ProtectionOhio Department of Health - Ohio PIC Certification Providers

Other Written Policies 4Any other document the state makes an employer write or hand out

LawProduceWhat it requiresTriggerEnforced by
Pay Stub Protection ActAI-compiledOhio Rev. Code § 4113.14 (HB 106, 135th GA; effective April 9, 2025)Every Ohio employerDistribute + ack
Notice
Give each employee a written or electronic statement, or access to one, on every regular payday showing total earnings for the pay period, itemised deductions such as taxes, benefits and garnishments, net pay after deductions, and hours worked where applicable. If an employee asks for a missing statement and the employer does not supply it within 10 business days, the employee may complain to the Division of Wage and Hour.
From the first employee
Ohio Department of Commerce, Division of Industrial Compliance, Wage and Hour Bureau
AuthorityOhio Department of Commerce - Paystub Protection Act information and complaintOhio Laws - Revised Code § 4113.14Ohio Legislature - HB 106 (135th GA)
Workers' compensation coverage (state fund)AI-compiledOhio Rev. Code ch. 4123Any Ohio employer with one or more employees; Ohio is a monopolistic state-fund state, so coverage comes from BWC rather than a private carrierFile
Filing / record
Apply to the Bureau of Workers' Compensation for coverage (form U-3) before or as soon as employees start, pay premiums and file payroll true-ups on time, and print and display the certificate of coverage from the BWC policy portal so employees can see the employer is covered.
From the first employee
Ohio Bureau of Workers' Compensation
AuthorityOhio BWC - Getting coverageOhio BWC - Managing your coverageOhio BWC - Application for Ohio Workers' Compensation Coverage (U-3)
New hire and contractor reportingAI-compiledOhio Rev. Code § 3121.89 et seq.Every Ohio employer, covering newly hired employees and independent contractors who live or work in OhioFile
Filing / record
Report every new hire and newly engaged contractor to the Ohio New Hire Reporting Center within 20 days of the start date, giving the worker's name, address and Social Security number along with the employer's name, address and federal identification number, and report changes in status.
From the first employee
Ohio Department of Job and Family Services, Office of Child Support
AuthorityOhio Department of Job and Family Services - Report New Hire and Changes in StatusODJFS - Ohio New Hire Reporting (PDF)
Minor work permits and minor labour rulesAI-compiledOhio Rev. Code ch. 4109Employers hiring workers under 18File
Filing / record
Complete the employer section of the minor work permit application with the student and guardian and have it filed with the student's school before the minor starts; agree wages with the minor in writing; keep the schedule of hours posted; and give a minor a 30-minute rest break after five consecutive hours of work.
From the first employee
Ohio Department of Commerce, Division of Industrial Compliance, Wage and Hour Bureau
AuthorityOhio Department of Commerce - Minor Work Permit ApplicationOhio Department of Commerce - Minor Labor Laws poster (PDF)Ohio Minor Work Permit portal

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Add the federal layer

Your business type, with Ohio on top

Small businessFederal + industry, with Ohio on topConstruction contractorsFederal + industry, with Ohio on topHealthcare practicesFederal + industry, with Ohio on topFood and beverage businessesFederal + industry, with Ohio on topTax and accounting firmsFederal + industry, with Ohio on topRegistered investment advisersFederal + industry, with Ohio on topInsurance agenciesFederal + industry, with Ohio on topRetail and e-commerceFederal + industry, with Ohio on topTrucking and logistics carriersFederal + industry, with Ohio on topNonprofitsFederal + industry, with Ohio on topFederal contractorsFederal + industry, with Ohio on top

Other states

The same index for another state

Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Consultants: advertise here

Sources

Ohio Laws - Revised Code chapter 1354Ohio Laws - Section 1354.02 (cybersecurity program)Ohio Laws - Section 1354.03 (recognised frameworks)Ohio Legislature - SB 220 (132nd GA)Ohio Laws - Revised Code § 1349.19Ohio Attorney General - Personal Information for ConsumersOhio Laws - Revised Code § 1349.192Ohio Department of Insurance - Information SecurityOhio Laws - Revised Code § 3965.02 (information security program)Ohio Laws - Revised Code chapter 3965Ohio Laws - Revised Code § 4112.054Ohio Legislature - HB 352 (133rd GA)Ohio Laws - Revised Code § 4112.02Ohio Department of Commerce - Paystub Protection Act information and complaintOhio Laws - Revised Code § 4113.14Ohio Legislature - HB 106 (135th GA)Ohio Department of Commerce - PostersOhio Department of Commerce - Minimum Wage PostersOhio Department of Commerce - Minor Labor Laws poster (PDF)Ohio BWC - About PERRPOhio BWC - PERRP required postersOSHA - State Plans (Ohio is under federal OSHA)Ohio Department of Health - Food Safety ProgramOhio Department of Health - Food Code Reference GuidesOhio Department of Health - Food Safety CertificationOhio Department of Health - Application for Ohio Manager Certification in Food ProtectionOhio Department of Health - Ohio PIC Certification ProvidersOhio BWC - Getting coverageOhio BWC - Managing your coverageOhio BWC - Application for Ohio Workers' Compensation Coverage (U-3)Ohio Department of Job and Family Services - Report New Hire and Changes in StatusODJFS - Ohio New Hire Reporting (PDF)Ohio Department of Commerce - Minor Work Permit ApplicationOhio Minor Work Permit portalOhio Laws - Revised Code § 4112.07Ohio Civil Rights Commission - EmploymentOhio Civil Rights Commission - Know Your Rights fair employment practices poster (PDF)

About this data

Pages on this site are compiled with AI from two or more linked sources, rewritten in our words, and reviewed by people in stages. Each record shows its stage and date. Nothing here is legal, audit or tax advice, and policyandcompliance.com accepts no responsibility for errors or for decisions made on it. Read the source, then decide.
How we compile and verify →

Think something is wrong?

corrections@policyandcompliance.com
Tell us the page and what you found. We check it against the source and fix it.
Corrections log →

Want to advertise here?

ads@policyandcompliance.com
A primary ad and a secondary placement, flat fee. Buying one changes nothing else on the page.