Law / United States / 
Oklahoma
Oklahoma Consumer Data Privacy Act, data protection assessments
Okla. Stat. tit. 75A, Sec. 309
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDFA comprehensive regime rule binding private bodies.
- Obligation class
- DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- The assessment duty takes effect on ; from that date, conduct and document a data protection assessment of your processing of personal data for targeted advertising, its sale, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, the processing of sensitive data, and any other processing that presents a heightened risk of harm to Oklahoma consumers (Okla. Stat. tit. 75A, Sec. 309(A)).
- In each assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (Okla. Stat. tit. 75A, Sec. 309(B)).
- Make a data protection assessment available to the Attorney General upon written request pursuant to a civil investigation demand (Okla. Stat. tit. 75A, Sec. 309(C)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment of each processing activity subsection A lists (309(A)), weighing the benefits of the processing against the risks as safeguards mitigate them (309(B)). The controller must make an assessment available to the Attorney General upon written request pursuant to a civil investigation demand (309(C)), and an assessment is confidential and exempt from the Oklahoma Open Records Act (309(D)). The section sets no period for keeping an assessment, and it applies to processing that commences on or after the effective date of the act, (309(G) and section 22 of the enrolled bill). The section has no scope clause; the reach is in the applicability section of the act, which this row does not cite, so no hook is taken.
- Kind
- Explicit
- As of
- Provision
- Okla. Stat. tit. 75A, Sec. 309(A) to (D) (documented data protection assessments)
- Trigger
- personal_data_processing
What this law does
A controller must conduct and document a data protection assessment of each processing activity that section 309 lists, which includes targeted advertising, the sale of personal data, certain profiling, the processing of sensitive data and any processing that presents a heightened risk of harm to consumers. A controller must make a data protection assessment available to the Attorney General upon written request pursuant to a civil investigation demand.
A data protection assessment is confidential and exempt from public inspection and copying under the Oklahoma Open Records Act. The assessment duty applies to processing activities that commence on or after the effective date of the act and is not retroactive. The act becomes effective on .
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web, deploys a chatbot, processes biometric data, processes voice recordings, trains models or makes high-risk automated decisions.