← All US breach laws·OK

Oklahoma data breach notification law

Oklahoma's data breach notification requirements under 24 Okla. Stat. §§161 to 166 (Security Breach Notification Act). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
24 Okla. Stat. §§161 to 166
Enforcer
Oklahoma Attorney General
AG notification
Not required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
Without unreasonable delay
Notify the state regulator
No general AG-notice requirement
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when there is reasonable likelihood that misuse has occurred or will occur
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Oklahoma law

First name/initial + last name with SSN, DL/state ID, financial account + access code

Penalties and enforcement

Civil penalty up to $150,000 per breach under Consumer Protection Act
Enforced by: Oklahoma Attorney General. Official regulator page →

Common pitfalls

⚠ Oklahoma's $150,000 per-breach cap applies regardless of resident count — large breaches still face full cap

Frequently asked questions

How long do I have to notify Oklahoma residents after a data breach?
Without unreasonable delay
Do I have to notify the Oklahoma Attorney General?
No general AG-notice requirement
Does Oklahoma require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Oklahoma's breach notification requirement?
Yes — Oklahoma has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Oklahoma residents sue me directly for a data breach?
No — Oklahoma's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Oklahoma law?
First name/initial + last name with SSN, DL/state ID, financial account + access code
What are the penalties for failing to comply with Oklahoma's breach notification law?
Civil penalty up to $150,000 per breach under Consumer Protection Act

Related state breach laws

North Dakota (ND)
N.D. Cent. Code §§51-30-01 to 51-30-07
Ohio (OH)
Ohio Rev. Code §§1349.19
Oregon (OR)
Ore. Rev. Stat. §§646A.600 to 646A.628
Pennsylvania (PA)
73 Pa. C.S. §§2301 to 2330

Pre-empt the Oklahoma breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Oklahoma's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit