Law / United States / 
Oklahoma
Oklahoma Consumer Data Privacy Act, consumer rights
Okla. Stat. tit. 75A, Secs. 301-303
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Give an Oklahoma consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy in a digital format.
- Offer an Oklahoma consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
- Respond to a consumer rights request within 45 days, with one 45-day extension available, and fulfill the first two requests each year free of charge.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the portability right in Okla. Stat. tit. 75A, § 301(B)(4) reach only personal data "that the consumer previously provided to the controller", or also data the controller obtained from other sources or inferred?
What it makes you log
Logging duty
The sections the row cites give a consumer the rights to confirm and access, correct, delete, port and opt out (Sec. 301), set a 45-day response period with a stated justification when a controller declines (Sec. 302), and require an appeal process answered in writing within 60 days (Sec. 303). Each is a duty to act on a request or to tell the consumer something; none requires a controller to keep a log or record of requests, decisions or processing. Sec. 302(F) lets a controller that obtained data from another source be deemed compliant with a deletion request either by retaining a record of the request or by opting the consumer out, so the record is one of two routes and not a duty. The burden on the controller to show a request is manifestly unfounded, excessive or repetitive (Sec. 302(D)) allocates proof in a fee dispute and names no record. The sections set no retention period, no audit and no access to a record. The hook is the definition of consumer in Sec. 300(8), a resident of this state, which the operative sections use; the applicability test in Sec. 314(A) sits outside this row.
- Kind
- None
- As of
What this law does
SB 546 Secs. 2-4 give an Oklahoma consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy in a digital format, and opt out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
A controller must respond within 45 days of a request, extendable once by 45 more days with notice to the consumer, must fulfill a request free of charge up to twice annually, and may charge a fee for a manifestly unfounded, excessive, or repetitive request only if the controller bears the burden of showing the request is such. A declined request may be appealed through a process the Act requires the controller to establish.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .