Oklahoma Data Breach Notification Law

What changed in the Oklahoma data breach notification law on January 1, 2026

Laws 2025, chapter 406 (reported as SB 626) did three things: it created an Attorney General report, broadened the protected data, and made penalties depend on whether reasonable safeguards were in place ¹². Breaches determined or reported to the business on or after January 1, 2026 fall under the new text ¹.

Residents still hear without unreasonable delay after the breach is determined or reported ¹, and only when it causes, or the business reasonably believes it has caused or will cause, identity theft or other fraud to an Oklahoma resident ¹.

The list now runs to biometric data, government-issued ID numbers, and electronic identifiers or routing codes with their access codes, beside the familiar name-plus-SSN, license or account entries ¹. Health and insurance records remain outside this statute.

The new Attorney General notice

At 500 or more Oklahoma residents, the Attorney General gets a report without unreasonable delay and within 60 days after the resident letters ¹. Below 500, no report. The filing has prescribed contents, among them the number of Oklahomans affected and, where known, the estimated monetary impact ¹.

The credit bureaus are not part of it ¹. Firms that store data for a client must alert that client as soon as practicable, so your managed IT and software contracts should spell out how fast ¹.

The AG notice also catches regulated businesses. GLBA financial institutions, HIPAA entities and businesses that follow their federal regulator's rules are deemed compliant only if they also notify the Attorney General ¹. A clinic that runs its response under HIPAA's breach letter rule still files the Oklahoma report.

Penalties now depend on your safeguards

The Attorney General or a district attorney has exclusive authority to sue for actual damages and a civil penalty of up to $150,000 per breach ². The 2026 changes split that by preparation ²:

• Reasonable safeguards and proper notice: no civil penalty.
• No reasonable safeguards, but proper notice: actual damages and a $75,000 penalty.

Preparation now has a price tag. A WISP and evidence of the controls behind it are how a small firm proves its safeguards were reasonable. Consumers cannot sue under this statute ².

Encrypted or redacted data is exempt unless it is accessed and acquired in unencrypted or unredacted form, or the breach involves a person with access to the encryption key ¹.

Two clocks to track after an Oklahoma breach

Mid-attack, an Oklahoma business with a cyber policy calls the carrier's claim line first, reports the attack to IC3 for the FBI, and does no rebuilding until the evidence is copied ³⁴⁵.

Then:

1. Contain the intrusion and map what was reached; your regular IT support can start, with a specialist response firm if it is beyond them.
2. Get the carrier's answer on counsel before calling a lawyer; how policies control the response explains why.
3. Count Oklahomans against the 500 line and list everyone else by state. Texas and Arkansas customers bring their own laws; all state rules side by side covers the rest.
4. Mail the residents, then put the AG report deadline, 60 days later, on the calendar.

Local IT support prices for Oklahoma City and Tulsa are on our city pages.

This summary reflects the amended statute as we read it on October 13, 2026. For legal advice on how the 2026 changes affect your business, ask an Oklahoma lawyer.