Ohio insurance data security law for agencies
By Tyler Mayberry · Cirlet. Published . Page updated .
A summary of public law and regulator guidance for independent agencies, checked October 28, 2026. It is not legal advice. Read the linked source and ask your counsel or the regulator how it applies to your agency.
Ohio’s cybersecurity law for insurance licensees, Ohio Revised Code Chapter 3965, has applied since March 20, 2019. A licensee must notify the Superintendent no later than three business days after determining that a qualifying cybersecurity event occurred. Smaller licensees are exempt from the written program requirement, not from notice.
The rules at a glance
| Insurance data security law | Ohio Revised Code Chapter 3965 (Senate Bill 273, 132nd General Assembly), effective March 20, 2019 |
|---|---|
| Notice to the Superintendent | “As promptly as possible … but in no event later than three business days” after determining that a qualifying cybersecurity event occurred (§ 3965.04(A)). Ohio must be the home state of an independent insurance agent, or the event must meet the section’s other criteria. |
| Small-licensee exemption | Exempt from the information security program in § 3965.02 with fewer than 20 employees, less than $5 million in gross annual revenue, or less than $10 million in year-end assets (§ 3965.07(A)). The exemption does not cover notice under § 3965.04. |
| General breach notice (any business) | “In the most expedient time possible but not later than forty-five days” after discovery, when the breach causes or is reasonably believed to cause a material risk of identity theft or other fraud (§ 1349.19(B)). |
NAIC model law: Adopted. The NAIC shows Ohio as adopting its Insurance Data Security Model Law (status as of October 8, 2026).
Ohio agencies’ public email records
In our October 2026 check of 33 Ohio independent agency website domains, 29 (88%) published one SPF record, 18 (55%) published a DMARC record and 8 (24%) asked receivers to quarantine or reject mail that fails. Public records show what a domain asks of receivers. They do not show whether an agency’s accounts or inboxes are protected.
What to prepare now
- Write down who decides that a cybersecurity event has occurred, and who files the notice, with a backup person.
- Keep the regulator’s notice route and the deadline above where you can reach them when email is unavailable.
- Ask your IT provider for evidence of multi-factor authentication on email and agency systems, and a list of everyone with administrator access.
- List the vendors that hold client information and how each will tell you about an incident.
Rehearse losing email access · Prepare for email fraud
Ohio questions
How fast must an Ohio agency report a cybersecurity event?
No later than three business days after determining that a qualifying event occurred (§ 3965.04(A)).
Is a small Ohio agency exempt?
From the written information security program, yes, if it has fewer than 20 employees, less than $5 million in gross annual revenue or less than $10 million in assets (§ 3965.07(A)). The exemption applies to § 3965.02 only, so the notice duty remains.
How long does an Ohio business have to notify affected residents?
The most expedient time possible, and no later than 45 days after discovery, subject to law-enforcement needs (§ 1349.19(B)(2)).
Sources
- Ohio Revised Code § 3965.04
- Ohio Revised Code § 3965.07
- Ohio Revised Code § 1349.19
- NAIC Model #668 adoption map, status as of October 8, 2026
Other states: Missouri · New York · Texas · California · All state pages