Municipalities
The same 45-day clock as everyone else. None of the legal shield.
Public entities are governed by ORC § 1347.12, your email is a public record under ORC § 149.43, and the Ohio Data Protection Act safe harbour is not available to you at all. Which leaves prevention doing all of the work.
Most public officials have never been told about that last part. It changes what is worth spending on.
ORC 1347.12
Your statute, not 1349.19.
No safe harbour
Chapter 1354 covers businesses only.
Public records
Email is producible on request.
No size threshold
A village counts the same as a city.
Why You Are Different
The safe harbour a private business can earn is not available to a political subdivision.
Ohio’s breach notification duty for public entities sits in ORC § 1347.12, which covers state agencies and agencies of a political subdivision. The deadline is the same forty-five days from discovery, and the definition of personal information is identical to the private-sector statute.
The difference is what happens next. ORC 1354.01 defines a covered entity as a business — limited liability companies, corporations, sole proprietorships, financial institutions and higher education. A city, village or township is not a business under that definition, so the affirmative defence a private firm earns by writing a cybersecurity program cannot be claimed by you.
That is not a reason to skip the written program. It is a reason to take prevention and the encryption exemption seriously, because for a public entity they are not one protection among several. They are the protection.
No shield means prevention is not the cheap option. It is the only option.
And it is all a public record
Under ORC § 149.43 municipal email is a public record, subject to your retention schedule and producible on request. Archiving is not an upgrade for a public body; it is how you answer a records request without a scramble.
What We Handle
Across departments, boards and the building
Records retention that runs itself
Email archiving with retention policies matched to your schedule, so records are kept as long as required and no longer.
Public records request handling
An indexed archive with search, legal hold and export, which turns a request into a search rather than a project.
Department network separation
Utilities, service, administration and safety kept appropriately separate rather than sharing one flat network built over decades.
Encryption everywhere it counts
Because the encryption exemption in ORC 1347.12 is the strongest protection actually available to a public entity.
Resident data protection
Utility billing, permits, payroll and court records all hold exactly what the statute defines as personal information.
Breach response planning
Who is told, in what order, within the 45 days — including council, counsel, your insurer and residents.
The statutory detail is set out in full on the secure email and Ohio compliance page.
Encrypt it, retain it, and be able to produce it. That is the job.
Questions
Questions from cities, villages and townships
Why does ORC 1347.12 apply to us instead of 1349.19?
1349.19 governs business entities conducting business in Ohio. 1347.12 governs state agencies and agencies of a political subdivision. Same 45-day deadline, same definition of personal information, different statute.
Can our village claim the Ohio safe harbour?
No. ORC 1354.01 defines a covered entity as a business, and a political subdivision is not one. This catches a lot of public officials by surprise, and it is the main reason prevention matters more for you than for a private firm.
We have three office staff. Does this still apply?
Yes. There is no headcount threshold in 1347.12, and small public bodies are targeted precisely because attackers assume the defences are thinner.
How does archiving help with public records requests?
An indexed archive with retention and export turns a request into a search, and keeps you inside your retention schedule automatically rather than relying on staff to remember what may be deleted.
Backup & Security Compliance
SOC 2 Type II platforms
The backup and security platforms we deploy are independently SOC 2 Type II audited.
HIPAA controls, BAAs signed
Configured to the HIPAA Security Rule, and we sign Business Associate Agreements.
PCI DSS aligned
Cardholder environments segmented, encrypted and logged to PCI DSS requirements.
Your One Stop I.T. Shop
Whenever You Are Ready
Let us look at where your village or city actually stands.
What is retained, what is encrypted, who can reach resident data, and whether you could answer a records request or a breach within the deadline. Plainly, with a real number attached.
No safe harbour. All the more reason to get it right first.
Chas Enterprise Group · Grafton, Ohio 44044 · (440) 364-3596 · charley.george@chasenterprisegroup.com