Ohio Rev. Code § 3965.08: Affirmative defense.

(A) A licensee that satisfies the provisions of this chapter shall be entitled to an affirmative defense to any cause of action sounding in tort that is brought under the laws of this state or in the courts of this state and that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning nonpublic information.

(B) The affirmative defenses permitted under this section shall not limit any other affirmative defenses available to a licensee.