Oklahoma
State Data Breach Notification Statue
Highlights
Covered Entities: Individuals or entities that own or license computerized data that includes personal information.
Consumer Notification: Notification must be provided to any Oklahoma resident whose “unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person,” when the unauthorized access and acquisition causes or is reasonably believed has caused or will cause identity theft or other fraud to an Oklahoma resident.
Regulatory Notification: Notification must be provided to the Oklahoma Attorney General where the number of Oklahoma residents to be notified exceeds 500.
Notification Timeline: Notification must be provided without unreasonable delay.
Data Format: Electronic.
Citations: 24 Okla. Stat. §§ 161–166
More Details
Definitions:
- Breach: Unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of PI, and that causes or is reasonably believed has caused or will cause, identity theft or other fraud to an Oklahoma resident.
- Personal information (PI): An individual’s first name / first initial and last name in combination with one or more of the following data elements:
- Social Security number;
- Driver’s license or other unique identification number created or collected by a government entity;
- Financial account or payment card number plus required expiration date, a security code, access code, or password that would permit access to a financial account.
- Unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or
- Unique biometric data such as fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual.
- Medical Information: N/A
- Health Insurance Information: N/A
Safe Harbors:
- Encryption: Notification is not required where the potentially impacted PI was encrypted, so long as the encryption key is not also available thereby rendering the PI readable / usable.
- Good Faith: Notification is not required where the potentially impacted PI was acquired in good faith by an employee or agent, provided that the PI is not used for a purpose other than the lawful purpose of the individual or entity or subject to further unauthorized disclosure.
- Risk of Harm: Notification is not required unless the breach causes or is reasonably believed has caused or will cause identity theft or other fraud to an Oklahoma resident.
- Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that the notification “will impede a criminal or civil investigation or homeland or national security.”
- Public Record: Personal Information does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.
Direct Notice:
- Timing: Notice must be provided without unreasonable delay unless requested by law enforcement, or consistent with measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system.
- Format: N/A
- Content: N/A
- Method: “Notice” means (1) written notice to the postal address in the records of the individual or entity; (2) telephone notice; (3) electronic notice; or (4) substitute notice.
Substitute Notice:
An individual or entity may provide substitute notice if (1) the cost of providing notice would exceed $50,000, (2) the notification population exceeds 100,000, or (3) the individual or entity does not have sufficient contact information or consent to provide direct notice. It must consist of any two of the following: (1) e-mail notice, if an e-mail address is available; (2) conspicuous posting on the individual or entity’s public web site, or (3) notice to statewide media.
Remediation Services:
N/A
Regulatory Notice:
An individual or entity required to provide notice to 500 or more Oklahoma residents must also provide notice to the Attorney General of such breach without unreasonable delay but in no event more than sixty (60) days after providing notice to impacted residents. The notice shall include the date of the breach, the date of its determination, the nature of the breach, the type of personal information exposed, the number of residents of this state affected, the estimated monetary impact of the breach to the extent such impact can be determined, and any reasonable safeguards the entity employs.
Credit Reporting Agencies Notice:
N/A
Third-Party Notice:
An individual or entity that maintains computerized data that includes PI that the individual or entity does not own or license must notify the owner or licensee of the information of a “breach” as soon as practicable following discovery, if the personal information was or if the entity reasonably believes it was accessed and acquired by an unauthorized person.
HIPAA:
An entity that complies with the notification requirements or procedures pursuant to the rules, regulation, procedures, or guidelines established by the primary or functional federal regulator of the entity shall be deemed to be in compliance with the provisions of this act.
Private Action:
N/A
Associated Regulations:
Insurance Data Security Act (26 O.S. §§ 670-679)
Oklahoma – Security Breach Notification Act
Highlights
Covered Entities:
All corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.
Consumer Notification:
An individual or entity that owns or licenses computerized data that includes personal information shall provide notice of any breach of the security of the system following determination or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of this state.
Regulatory Notification:
If a breach of the security of a system affects the personal information of more than 500 individuals, an individual or entity is required to provide notice to the Attorney General of such breach without unreasonable delay but in no event more than sixty (60) days after providing notice to impacted residents of this state as required by this section.
Notification Timeline:
The disclosure shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the disclosure shall be made.
Citations: 2025 Okla. Sess. Law Serv. Ch. 406 (S.B. 626). Effective January 1, 2026.
More Details
Definitions:
Breach of the security of a system: The unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of this state.
Personal Information: An individual’s first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through the breach of security:
- Social security number,
- Driver license number or other unique identification number created or collected by a government entity,
- Financial account number, or credit card or debit card number, in combination with any required expiration date, security code, access code, or password that would permit access to an individual’s financial account,
- Unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual’s financial account, or
- Unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual.
Reasonable safeguards: Policies and practices that ensure personal information is secure, taking into consideration an entity’s size and the type and amount of personal information. The term includes, but is not limited to, conducting risk assessments, implementing technical and physical layered defenses, employee training on handling personal information, and establishing an incident response plan.
Regulatory Notice:
An individual or entity required to provide notice to more than 500 residents of this state shall also provide notice to the Attorney General of such breach without unreasonable delay but in no event more than sixty (60) days after providing notice to impacted residents of this state as required by this section. The notice shall include the date of the breach, the date of its determination, the nature of the breach, the type of personal information exposed, the number of residents of this state affected, the estimated monetary impact of the breach to the extent such impact can be determined, and any reasonable safeguards the entity employs. Further, if an individual or entity discloses a breach of a security system to more than 1,000 residents of this state are affected within a single breach shall notify consumer reporting agencies.
Third-Party Notice Requirements:
An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall provide notice to the owner or licensee of the information of any breach of the security of the system as soon as practicable following determination, if the personal information was or if the entity reasonably believes it was accessed and acquired by an unauthorized person.
Penalties:
The Attorney General or a district attorney shall have exclusive authority to bring an action and may obtain actual damages for a violation of the Security Breach Notification Act and a civil penalty not to exceed One Hundred Fifty Thousand Dollars ($150,000.00) per breach of the security of the system or series of breaches of a similar nature that are determined in a single investigation. Civil penalties shall be based upon the magnitude of the breach, the extent to which the behavior of the individual or entity contributed to the breach, and any failure to provide the notice required.
Associated Regulations:
N/A
