Law / United States / 
Oklahoma
Security Breach Notification Act
Okla. Stat. tit. 24, Secs. 162-166
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDFIn force since , effective .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Provide notice of a breach of security involving personal information without unreasonable delay.
- If you maintain computerized data that includes personal information you do not own or license, notify the owner or licensee of any breach of the security of the system as soon as practicable following determination of the breach, where the information was or is reasonably believed to have been accessed and acquired by an unauthorized person.
- Notify the Oklahoma Attorney General within 60 days of consumer notice if the breach affects 500 or more Oklahoma residents (1,000 or more for a breach maintained by a credit bureau).
- Do not assume a bare identification use of a recording-derived identifier is covered biometric data under this statute. Its definition is bound to authentication use, not identification generally, and carries no exclusion or clawback clause either way.
These lines are LexLint's reading of the law's text. Also read by: Office of the Oklahoma Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://oklahoma.gov/oag/complaints-tiplines/complaints/data-breach.html
- Guidance body
- Office of the Oklahoma Attorney General
- Open questions
- Does a faceprint or voiceprint that a data holder derives from a recording in order to identify a person count as "unique biometric data" under Okla. Stat. tit. 24, ยง 162, when the definition speaks of data used "to authenticate a specific individual"?
What it makes you log
Logging duty
The Security Breach Notification Act requires notice of a breach to affected Oklahoma residents without unreasonable delay (Sec. 163(A)), and, since the 2025 amendment effective , notice to the Attorney General within 60 days after residents are notified when 500 or more residents are affected (Sec. 163(E)). Those are notices with stated contents. No section requires an entity to keep a record of breaches, to document its investigation or to retain anything for a period, and no section names an audit or a right to a record. Sec. 164 deems an entity compliant when it follows its own notification procedures or a federal regulator's rules, and Sec. 165(C) makes reasonable safeguards plus notice an affirmative defense; neither sets a record duty. The row's own page on the court network sits behind a verification wall, so the pins use the enrolled amending bill.
- Kind
- None
- As of
What this law does
An individual or entity, defined to include a government, governmental subdivision, agency, or instrumentality as well as a private organization, that owns or licenses computerized data including personal information must provide notice of a breach of security without unreasonable delay.
Personal information includes a name combined with a Social Security number, a driver's license or government-issued identification number, a financial account number, or unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual, and excludes information lawfully obtained from publicly available sources or government records.
Because this definition is purpose-bound to authentication rather than identification generally, and carries neither an exclusion nor a clawback clause, whether an identifier algorithmically derived from a public recording to identify, rather than authenticate access for, a person falls within it cannot be determined from the text; such an identifier would most likely fail the definition's own authentication threshold rather than being excluded by an express carve-out.
Notice to the Attorney General is required within 60 days of consumer notice for a breach affecting 500 or more residents (1,000 or more for a credit-bureau-maintained breach); smaller breaches are exempt from Attorney General notice entirely.
The Attorney General or a district attorney has exclusive authority to enforce a violation causing injury or loss, in the same manner as an unlawful practice under the Oklahoma Consumer Protection Act, and may recover actual damages and a civil penalty of up to $150,000 per breach; the statute creates no private right of action, and reasonable safeguards plus compliant notice is an affirmative defense against the state's own civil-penalty action, not a private plaintiff's claim.
Originally enacted by Laws 2008, House Bill 2245, effective , and most recently and substantially amended by Laws 2025, Senate Bill 626, effective .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .