Yahoo. Equifax. LinkedIn. Target. Aside from being some of the world’s largest corporate entities, these companies are just a few of the more noteworthy businesses that have fallen victim to data breach incidents in recent years. Companies large and small today now face the tough reality that it is no longer a matter of “if,” but rather “when,” a company’s network will be breached.

Over the years, lawmakers have struggled with devising effective methods for enhancing the cybersecurity of private organizations without mandating one-size-fits-all requirements that undercut effective data security management. At the beginning of November, Senate Bill 220, also known as the Ohio Data Protection Act, was enacted into law in the state of Ohio—which represents the first law that accomplishes just that goal.