Constangy Cyber Advisor 

The Act applies to covered entities who are individuals or entities who own or license computerized data that includes personal information of Oklahoma residents. Third parties who maintain data of Oklahoma residents that they do not own, are required to notify the data owner immediately following the discovery of a breach.  

The Act defines a “breach” as the unauthorized access and acquisition of unencrypted and unredacted computerized data that (1) compromises the security or confidentiality of personal information, and that (2) causes or is reasonably believed to have caused an Oklahoma resident to be the victim of identity theft or other fraud. 

The Act before SB 626

The previous version of the Act defined “personal information” as an individual’s first name or first initial and last name, in combination with one or more of the following data elements:

• Social Security number.
• Driver’s license or state identification card number.
• Financial account or payment card number plus a security code, access code, or password that would permit access to a financial account.

The definition of “personal information” did not include medical or health insurance information. Additionally, notices to individuals were to be issued “without unreasonable delay.” The Act did not require notice to the Oklahoma Attorney General’s office or to the three credit reporting agencies (TransUnion, Experian, and Equifax).

The original Act includes a “safe harbor” provision which allows the good-faith acquisition of personal information by an employee or agent, provided that the information is not used for any purpose other than the lawful purposes for which the information was originally obtained. The information may also not be “subject to further unauthorized acquisition.”  There is also an “encryption” safe harbor. Under the original statute, potentially affected individuals did not have to be notified of a breach if their personal information was encrypted and if the encryption key was not available.

Changes effective now

Here is a summary of the changes that took effect on January 1, 2026.

Expanded definition of “personal information.” Personal information, or “PI,” is now defined as an individual’s first name or first initial and last name, in combination with any one of the following data elements that relate to the individual, if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology to make the name or data elements unreadable:

• Social Security number.
• Driver’s license or state identification card number.
• Financial account or payment card number plus a security code, access code, or password that would permit access to a financial account.
• Biometric data and electronic identification numbers.
• Email addresses or internet account numbers.

“Biometric data” is generally defined as” unique physical or behavioral characteristics used to identify and verify an individual’s identity”, including fingerprints, retinal scans, and “other” unique physical or digital representations.

“Electronic identifiers” include routing codes in combination with any required security code, access code, or password that would permit access to an individual’s financial account.

The amended definition of PI does not include medical information or health insurance information – data elements that are included in many other states’ breach notification laws. 

Safe harbor provision. The safe harbor provision was modified by striking the word “further” so that the “good faith acquisition” cannot be subject to unauthorized acquisition at all.

Notice to Oklahoma Attorney General and credit reporting agencies. The Oklahoma Attorney General’s office now requires notice of breaches without “unreasonable delay,” but not later than 60 days after individual notifications are issued to more than 500 Oklahoma residents.  

The notice must include the type of personal information exposed, the number of Oklahoma residents affected, the estimated monetary impact of the breach (to the extent that the impact can be determined), and any reasonable safeguards that the entity employs.

If more than 1,000 Oklahoma residents are individually notified, the covered entity must also notify the three credit bureau agencies.

Civil penalty caps. SB 626 also establishes penalty caps for covered entities. There is a cap of $150,000 per breach for entities who fail to comply with notice requirements and did not implement “reasonable safeguards.” If an entity failed to put into place “reasonable safeguards” but did provide timely notification, the cap is $75,000 per breach.

The “reasonable safeguards” defense. SB 626 introduces a “reasonable safeguards” affirmative defense. If an entity shows that it implemented reasonable safeguards during the breach and provided compliant notice, it may not be subject to civil penalties. The reasonable safeguards are measured against the entity’s size and the amount of PI maintained. “Reasonable safeguards” include the following:

• Regular risk assessments.
• Multiple, overlapping layers of technical and physical protections designed to deter, detect and respond to threats of unauthorized access.
• Employee training in handling PI.
• An incident response plan.

Federal compliance exemptions

The text of SB 626 acknowledges that certain entities may have their own notice procedures as part of information privacy or security policies based on the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, or those established by their functional federal regulator. If so, those entities are exempt from the Oklahoma requirements as long their internal procedures are as thorough as the state requirements.

“Before and after”

Here’s a handy table to track the “before SB 626” and after of the Oklahoma Security Breach Notification Act:

The Constangy Cybersecurity & Data Privacy Team helps businesses of all sizes and industries develop a comprehensive incident response plan or support with a breach. We are here to help! The Constangy Cyber Team is available 24/7. Contact us at breachresponse@constangy.com or by phone at 877-DTA-BRCH.