1. Home
  2. State breach laws
  3. Oklahoma

Oklahoma data breach notification law

What Oklahoma requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Okla. Stat. tit. 24, §§ 161–166 (Security Breach Notification Act), as amended by SB 626 (2025), effective January 1, 2026.

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
Penalty relief
Liability protection

What this means if you sell security services

Oklahoma sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits. Oklahoma also reduces penalties for organizations that kept reasonable safeguards and notified properly, which makes a documented security program worth having.

See recent Oklahoma breach filings →

Requirements in detail

Statute
Okla. Stat. tit. 24, §§ 161–166 (Security Breach Notification Act), as amended by SB 626 (2025), effective January 1, 2026
Deadline to notify residents
Without unreasonable delay after determining or being notified of the breach, allowing time to determine its scope and restore the integrity of the system. Notice may be delayed if law enforcement advises that it would impede a criminal or civil investigation or homeland or national security.
Attorney General notification
Yes, without unreasonable delay and no later than 60 days after notifying affected residents, when 500 or more Oklahoma residents are affected by a single breach. For breaches at credit bureaus, the threshold is 1,000 or more residents. The notice must describe the breach, the types of information exposed, the number of residents affected, the estimated monetary impact, and the safeguards the organization uses. Organizations that follow federal notice rules (such as banks under Gramm-Leach-Bliley or HIPAA-covered entities) are treated as compliant with resident notice if they still notify the Attorney General.
Penalties
The Attorney General or a district attorney has exclusive authority to sue for violations that cause injury or loss to residents. They may recover actual damages and a civil penalty of up to $150,000 per breach, or per series of similar breaches found in a single investigation. An organization that used reasonable safeguards and gave proper notice is not subject to civil penalties. An organization that gave proper notice but lacked reasonable safeguards faces actual damages and a $75,000 civil penalty. Violations by state-chartered or state-licensed financial institutions are enforced only by their primary state regulator.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Oklahoma's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
Since January 1, 2026, an organization that maintained reasonable safeguards and notified properly is exempt from civil penalties under the breach notification act and has an affirmative defense in actions brought under it. Without safeguards but with proper notice, penalties are capped at $75,000. A separate 2023 law gives hospitals an affirmative defense to breach tort claims. These protections limit lawsuits; they don't change the duty to notify. 24 Okla. Stat. § 165(C) (SB 626, 2025); 18 Okla. Stat. §§ 2068–2072
Recent changes
SB 626 (2025), effective January 1, 2026, added Attorney General notice for breaches affecting 500 or more residents, expanded personal information to include biometric data, other government-issued identification numbers, and electronic identifiers or routing codes, changed the trigger from discovery to determination of the breach, and created the reasonable-safeguards penalty relief described above.

Oklahoma breach notification FAQ

What is the data breach notification deadline in Oklahoma?

Without unreasonable delay after determining or being notified of the breach, allowing time to determine its scope and restore the integrity of the system. Notice may be delayed if law enforcement advises that it would impede a criminal or civil investigation or homeland or national security. The governing law is Okla. Stat. tit. 24, §§ 161–166 (Security Breach Notification Act), as amended by SB 626 (2025), effective January 1, 2026.

Does Oklahoma require notifying the Attorney General of a data breach?

Yes, without unreasonable delay and no later than 60 days after notifying affected residents, when 500 or more Oklahoma residents are affected by a single breach. For breaches at credit bureaus, the threshold is 1,000 or more residents. The notice must describe the breach, the types of information exposed, the number of residents affected, the estimated monetary impact, and the safeguards the organization uses. Organizations that follow federal notice rules (such as banks under Gramm-Leach-Bliley or HIPAA-covered entities) are treated as compliant with resident notice if they still notify the Attorney General.

What are the penalties for failing to report a data breach in Oklahoma?

The Attorney General or a district attorney has exclusive authority to sue for violations that cause injury or loss to residents. They may recover actual damages and a civil penalty of up to $150,000 per breach, or per series of similar breaches found in a single investigation. An organization that used reasonable safeguards and gave proper notice is not subject to civil penalties. An organization that gave proper notice but lacked reasonable safeguards faces actual damages and a $75,000 civil penalty. Violations by state-chartered or state-licensed financial institutions are enforced only by their primary state regulator.

Can individuals sue over a data breach in Oklahoma?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Oklahoma?

Oklahoma's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Oklahoma limit breach lawsuits for companies with a cybersecurity program?

Since January 1, 2026, an organization that maintained reasonable safeguards and notified properly is exempt from civil penalties under the breach notification act and has an affirmative defense in actions brought under it. Without safeguards but with proper notice, penalties are capped at $75,000. A separate 2023 law gives hospitals an affirmative defense to breach tort claims. These protections limit lawsuits; they don't change the duty to notify.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Oklahoma Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →