← All jurisdictions
OK · data breach notification
highOklahoma
Okla. Stat. tit. 24 §§161–166 (SB 626, eff. 1/1/2026)
Individual deadline
No fixed limit
Trigger standard
Risk of harm
AG / regulator
Required
| Notice to individuals | in the most expedient time possible and without unreasonable delay |
| Risk-of-harm standard | notice where breach creates reasonable belief of misuse; expanded PI definitions effective 2026 |
| Encryption safe harbor | Yes, encrypted data (key not compromised) generally exempt. |
| Regulator notice | Oklahoma Attorney General, required above 500 residents; within 60 days Written notice to AG No later than 60 days AFTER providing notice to residents |
| Credit reporting agencies | Notify CRAs above 1,000 residents. |
| Substitute notice | Available if cost exceeds $50,000 or more than 100,000 affected. |
| Private right of action | No, enforcement by the state. |
| Penalties | Up to $150,000 per breach (safeguards absent) or $75,000 + actual damages (safeguards present, notice noncompliant); reasonable-safeguards affirmative defense |
| Notable PI definitions | Includes biometric, credentials, passport, military id. |
Notes
※ Individual deadline remains 'without unreasonable delay' — the 60-day clock is the AG deadline
Rule last verified July 10, 2026 · confidence high. This is a reference summary, not legal advice; verify against the current statute. How we compile this →
Is a Oklahoma breach part of a multi-state incident?
See every jurisdiction at once, with letters and filing packets generated.
Run the calculator →