Oklahoma Security Breach Notification Act (24 O.S. §§ 161-166)

Establishes requirements for data breach notification and reasonable data security measures. Requires notification to affected individuals within 60 days. Includes specific provisions for encrypted data and law enforcement delays. Supplemented by sector-specific requirements for insurance and healthcare data.

JurisdictionOklahoma
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Oklahoma Security Breach Notification Act (24 O.S. §§ 161-166) establishes the following key requirements:

  • Notification Obligation: Entities must disclose any breach of security to affected Oklahoma residents whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person Oklahoma Statutes.
  • Timing of Notification: Disclosure must be made "without unreasonable delay," consistent with measures necessary to determine the scope of the breach and restore system integrity Oklahoma Statutes.
  • Personal Information Definition: Includes first name or initial and last name combined with Social Security number, driver's license number, or financial account information Oklahoma Statutes.
  • Encryption Safe Harbor: The act does not apply to encrypted information, unless the encryption key was also accessed or acquired Oklahoma Statutes.
  • Third-Party Data Notification: Entities maintaining data on behalf of others must notify the data owner of any breach Oklahoma Statutes.
  • Method of Notice: Written, telephonic, or electronic notice is acceptable, with substitute notice available under certain circumstances Oklahoma Statutes.

Compliance Challenges

Organizations face several challenges in complying with the Oklahoma Security Breach Notification Act:

  • Encryption Implementation: Ensuring proper encryption of all personal information to qualify for safe harbor provisions NIST Encryption Guidelines.
  • Multi-State Compliance: For businesses operating across state lines, navigating different state breach notification laws adds complexity IAPP U.S. State Data Breach Lists.

Implementation Best Practices

To effectively implement the Oklahoma Security Breach Notification Act requirements:

Recent Updates

As of 2024, there have been no significant recent updates to the Oklahoma Security Breach Notification Act. However:

Related Regulations

The Oklahoma Security Breach Notification Act interacts with several related regulations:

  • HIPAA Breach Notification Rule: For healthcare entities, this federal rule may apply in addition to state requirements HHS Breach Notification Rule.
  • Gramm-Leach-Bliley Act (GLBA): Financial institutions must comply with both GLBA and state breach notification laws FTC GLBA.
  • Oklahoma Consumer Protection Act: May apply in cases of unfair or deceptive practices related to data breaches Oklahoma Attorney General.

Industry Impact

The Oklahoma Security Breach Notification Act has significant impacts across industries:

Sources

Recent developments

  • — SHRM reports that Oklahoma enacted **Senate Bill 626**, significantly expanding the Security Breach Notification Act effective Jan. 1, 2026, including broader personal information definitions (adding certain electronic identifiers and biometric data), mandatory attorney general notification above specified thresholds, and revised penalty and affirmative defense provisions.[7] (source)
  • — SHRM discusses industry impact, noting that employers and other covered entities will need to enhance data inventories, breach assessment processes, and documentation to address the expanded definition of “personal information,” AG reporting content requirements (including estimated monetary impact and safeguards), and coordination with HIPAA and the Oklahoma Hospital Cybersecurity Protection Act exemptions.[7] (source)
  • — The Oklahoma Bar Association outlines practical implications of the updated Security Breach Notification Act for law firms, emphasizing new covered data types (including biometric identifiers and certain electronic credentials), new attorney general notice requirements for larger breaches, and the need to adjust incident response plans before the Jan. 1, 2026 effective date.[1] (source)
  • — The Oklahoma Bar Association highlights that law firms and other professional services organizations handling client personal data must review engagement terms, update incident response procedures, and train staff on the broadened scope of “sensitive data” and new AG notification thresholds to manage enforcement and reputational risks under the amended Act.[1] (source)
  • — Davis Wright Tremaine’s state law tracker summarizes Oklahoma’s amended Security Breach Notification Act (24 O.S. §§ 161–166 as amended by SB 626), noting the harm threshold, “without unreasonable delay” timing standard, new AG notice requirement for breaches involving more than 499 residents, added biometric and electronic identifier data elements, and updated civil penalties and defenses.[5] (source)
  • — McAfee & Taft analyzes SB 626’s amendments to the Oklahoma Security Breach Notification Act, including the new obligation to notify the attorney general for breaches impacting 500+ residents, expanded definition of protected personal information to include unique biometric data, and a restructured penalty scheme that reduces or eliminates penalties where entities provide notice and use “reasonable safeguards.”[3] (source)
  • — A JD Supra client alert explains that SB 626, introduced in January 2025, modifies Oklahoma’s Security Breach Notification Act by adding AG notification for large breaches, expanding protected personal information (including fingerprints and retina images), and creating a compromise penalty framework that halves penalties where proper notice is given and eliminates them where reasonable safeguards are in place.[6] (source)
  • — McAfee & Taft notes that business and consumer advocates previously clashed over the size of civil penalties, and that SB 626’s reduced penalties and affirmative defenses (for entities that provide required notice and implement reasonable safeguards) are viewed as a compromise that will influence how companies in Oklahoma structure their cybersecurity and breach response programs.[3][6] (source)
  • — The enrolled version of **SB 626** as passed by the Oklahoma Legislature formally amends 24 O.S. §§ 161–166, updates the Act’s applicability, and sets an effective date of **January 1, 2026**, aligning new breach notification, AG reporting, and penalty provisions with that date.[2] (source)
  • — Justia’s updated codification of Okla. Stat. § 24-163 reflects the current duty to disclose security breaches to affected Oklahoma residents, underscoring that the amended Act still uses a harm-based trigger (identity theft or fraud risk) and preserves obligations on both data owners and maintainers, which industry commentators note must now be interpreted in light of SB 626’s expanded data elements and AG notice requirement.[4][5] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates