Law / United States / 
Oklahoma
Oklahoma Consumer Data Privacy Act, de-identified and pseudonymous data
Okla. Stat. tit. 75A, Sec. 310
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDFA de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- From , take reasonable measures to ensure that de-identified data you hold cannot be associated with an individual (Okla. Stat. tit. 75A, Sec. 310(A)(1)).
- Publicly commit to process de-identified data only in a de-identified fashion and not to attempt to reidentify it (Okla. Stat. tit. 75A, Sec. 310(A)(2)).
- Contractually obligate any recipient of de-identified data to comply with the same requirements, and monitor each recipient's compliance with those contractual commitments (Okla. Stat. tit. 75A, Sec. 310(A)(3) and (D)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sec. 310 sets three conditions for a controller that holds de-identified data (310(A)) and a duty to monitor recipients' compliance with their contractual commitments (310(D)). It states no log or record duty, names no audit and gives no party a right to a record.
- Kind
- None
- As of
What this law does
A controller in possession of de-identified data must take reasonable measures to ensure that the data cannot be associated with an individual, publicly commit to process it only in a de-identified fashion and not attempt to reidentify it, and contractually obligate any recipient to comply with those requirements (SB 546 Sec. 11(A)).
The consumer rights to confirm and access, correct, delete and port personal data, and the controller duties under Section 7 of the Act, do not apply to pseudonymous data when the controller can demonstrate that the information needed to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing it.
A controller that discloses pseudonymous data or de-identified data must exercise reasonable oversight to monitor compliance with the contractual commitments attached to the data and take appropriate steps to address any breach of them. The Act defines de-identified data as data that cannot reasonably be linked to an identified or identifiable individual or a device linked to the individual. Section 22 of the enrolled act sets the effective date as , not yet reached.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .