Oklahoma Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Oklahoma's data breach notification requirements underwent a major overhaul with the passage of Senate Bill 626, effective January 1, 2026. The amended Security Breach Notification Act (Okla. Stat. tit. 24, Sections 161 through 166) expanded the definition of personal information, introduced a formal Attorney General notification requirement, established specific penalty caps, and created a "reasonable safeguards" affirmative defense that rewards businesses for proactive cybersecurity investments.

This guide covers the full scope of Oklahoma's breach notification requirements as amended by SB 626, including what personal information triggers the law, who must be notified, the timeline, enforcement penalties, exemptions, and how the law connects to the state's [broader data privacy framework](/us-laws/data-privacy-laws/oklahoma-data-privacy-laws).

Who Must Comply With Oklahoma's Breach Notification Law

Oklahoma's breach notification law applies to any individual or entity that owns or licenses computerized data that includes personal information of Oklahoma residents. It also applies to any individual or entity that conducts business in Oklahoma and owns or licenses computerized data containing personal information.

Third-party data maintainers who do not own or license the data but maintain it on behalf of another entity must notify the data owner of any breach immediately following discovery. The data owner then carries the obligation to notify affected consumers and regulators.

Out-of-state businesses holding Oklahoma residents' data are fully subject to the law.

What Qualifies as a Security Breach

Under the amended statute, a breach of the security of a system means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by the entity as part of a database of personal information regarding multiple individuals.

The definition focuses on "unauthorized access and acquisition," meaning both elements must be present. Mere unauthorized access without actual acquisition of data does not trigger notification.

Good Faith Exception

A good faith acquisition of personal information by an employee or agent of the entity for the purposes of the entity's business does not constitute a breach, provided the personal information is not used for an unauthorized purpose or subject to further unauthorized disclosure.

The Encryption Safe Harbor

Oklahoma provides an encryption safe harbor, but with important conditions. Encrypted or redacted data does not trigger notification requirements, unless:

• The encrypted data is accessed and acquired in an unencrypted or unredacted form, or
• The breach involves a person with access to the encryption key, and the entity reasonably believes the breach has caused or will cause identity theft or other fraud

This means businesses cannot rely solely on encryption to avoid notification obligations if the encryption key was also compromised or if fraud is likely.

What Personal Information Triggers the Law

Under SB 626, the definition of personal information was significantly expanded. Personal information now means an individual's first name or first initial and last name in combination with any of the following data elements:

• Social Security number
• Driver's license number or state identification card number
• Financial account number, credit card number, or debit card number, in combination with any required security code, access code, or password
• Biometric data (fingerprints, retinal scans, and other identifying biometric information) (new under SB 626)
• Electronic identification numbers, email addresses, or internet account numbers in combination with passwords or security questions that permit access to an online account (new under SB 626)

The addition of biometric data is significant for businesses that use fingerprint-based time clocks, facial recognition systems, or biometric authentication for mobile apps and secure facilities. These types of data are now fully covered by the notification statute.

Personal information does not include information that is lawfully obtained from publicly available sources or from federal, state, or local government records lawfully made available to the general public.

Notification Timeline

Oklahoma does not impose a single fixed deadline for notifying affected individuals. The statute requires notification "without unreasonable delay," consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the integrity of the system.

However, SB 626 introduced a specific 60-day deadline for Attorney General notification. When a breach affects 500 or more Oklahoma residents, the entity must notify the AG without unreasonable delay and no later than 60 days after providing notice to residents.

Law enforcement may request a delay if notification would impede a criminal investigation. Once law enforcement determines that notification will no longer be impeded, the entity must provide notice without unreasonable delay.

Who Must Be Notified

Affected Individuals

Every Oklahoma resident whose personal information was compromised in a manner that causes or is reasonably believed to cause identity theft or other fraud must receive notification.

Attorney General

Under SB 626, the Oklahoma Attorney General must be notified when a breach affects 500 or more Oklahoma residents. The AG notification must be made within 60 days of providing notice to affected residents and must include:

• A description of the breach
• The number of affected Oklahoma residents
• Steps taken to investigate and remediate
• The timing and content of consumer notice

Consumer Reporting Agencies

When a breach affects 1,000 or more Oklahoma residents, the entity must also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis.

Methods of Notification

Businesses can provide notification through:

• Written notice sent to the individual's last known mailing address
• Electronic notice consistent with the federal E-SIGN Act
• Telephone notice directly to the affected individual

Substitute Notice

Substitute notice is available if the entity demonstrates that:

• The cost of providing notice would exceed $50,000, or
• The affected class exceeds 100,000 persons, or
• The entity does not have sufficient contact information or consent

Oklahoma's substitute notice thresholds are notably lower than most states ($50,000 cost and 100,000 persons vs. the more common $250,000 and 500,000). Substitute notice must include email notice (where available), conspicuous posting on the entity's website, and notification to major statewide media.

Enforcement and Penalties

Civil Penalties

SB 626 established specific penalty caps:

• $150,000 per breach for entities that fail to comply with the notification requirements and did not implement reasonable safeguards
• $75,000 per breach for entities that fail to implement reasonable safeguards but did provide timely notice

The Reasonable Safeguards Affirmative Defense

One of SB 626's most significant additions is the "reasonable safeguards" affirmative defense. An entity that demonstrates it implemented reasonable safeguards at the time of the breach and provided notice in accordance with the statute is not subject to civil penalties and can raise compliance as an affirmative defense in civil actions.

Reasonable safeguards are defined as policies and practices that ensure personal information is secure, taking into consideration the entity's size and the type and amount of personal information maintained. Qualifying measures include:

• Conducting regular risk assessments
• Implementing technical and physical layered defenses
• Training employees on handling personal information
• Establishing an incident response plan

This provision incentivizes businesses to invest in proactive cybersecurity measures rather than treating breach notification as a purely reactive obligation.

No Private Right of Action

Oklahoma's breach notification statute does not create a private right of action. Individuals cannot sue businesses directly under this law for breach notification failures. Enforcement is handled by the Attorney General.

Exemptions

Federal Compliance Exemptions

Entities that maintain their own notification procedures as part of an information privacy or security policy are deemed in compliance, provided those procedures are at least as thorough as the state's requirements.

Financial institutions subject to and in compliance with the Gramm-Leach-Bliley Act's interagency guidance on breach notification are also exempt from the state requirements.

Entities subject to and in compliance with HIPAA's breach notification requirements are deemed in compliance with Oklahoma's statute.

What Changed Under SB 626 (Summary)

For businesses already familiar with Oklahoma's earlier breach notification law, here are the key changes effective January 1, 2026:

Feature	Before SB 626	After SB 626
Personal information	SSN, DL, financial accounts	Added biometric data, electronic credentials
AG notification	Not required	Required at 500+ affected residents
AG deadline	N/A	60 days after consumer notice
Penalty cap	None specified	$150,000 per breach ($75,000 with safeguards)
Reasonable safeguards defense	Not available	Full affirmative defense
CRA notification	Not explicitly required	Required at 1,000+ affected residents

More Oklahoma Laws

• Oklahoma Recording Laws
• Oklahoma Recording Laws
• Oklahoma Recording Laws
• Oklahoma Data Privacy Laws
• Oklahoma Lemon Laws
• Oklahoma Recording Laws
• Oklahoma Recording Laws
• Oklahoma Recording Laws

Sources and References

This article draws from the following official Oklahoma government sources:

• Oklahoma SB 626 (Enrolled Version) - Full text of the 2025 amendment to the Security Breach Notification Act
• SB 626 Bill Information - Legislative history and status
• Oklahoma Office of the Attorney General - AG enforcement authority
• Oklahoma OMES Cybersecurity Breaches - State cybersecurity breach notices

This article provides general legal information about Oklahoma data privacy laws and breach notification requirements. It is not legal advice, and it does not create an attorney-client relationship. Data breach response involves time-sensitive obligations. Consult a qualified attorney licensed in Oklahoma for guidance specific to your situation.