Oklahoma. Breach notification. Act
OK breach lawOklahoma data breach notification law (Okla. Stat. tit. 24, §§ 161-166 (Security Breach Notification Act); tit. 74, § 3113.1)
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Oklahoma residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN, government ID, financial account/electronic identifier with codes, biometric data.
- Key themes
- Unique features
Penalty scale depends on whether the entity had reasonable safeguards: compliant entities face no civil penalty; HIPAA/GLBA compliance satisfies individual notice if AG notice is given.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Oklahoma requires the maintaining entity to notify the owner as soon as practicable after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay; AG within 60 days after individual notice if >=500 residents (>=1,000 for credit bureaus)
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $150,000 per breach; $75,000 cap plus actual damages where notice given but safeguards lacking
§3Dates
- Key dates
- Adopted
- In force
- SB 626 became law 2025-05-28 without signature, effective 2026-01-01: AG notice, biometrics, reasonable-safeguards safe harbour
§4Text and authority
- Text
- Authoritative text oscn.net
- Authority
- Oklahoma Attorney General
§5Where it applies
- Domestic law of
- Oklahoma
§6Sources and verification
- Sources consulted
- Verification
High confidence.