Oklahoma recently enacted Senate Bill 626, which substantially amends the state’s data breach notification law to broaden the scope of notification obligations and add a new regulator notification requirement along with a new “safe harbor”-style provision that provides liability protections if certain security measures are implemented.  The changes to Oklahoma’s law follow changes to other state data breach notification laws within the past year, including New York’s addition of a 30-day deadline for notice to individuals (added in early 2025) and Pennsylvania’s addition of a regulator notification requirement and obligations to provide free credit monitoring (added in mid-2024).  Key updates from Oklahoma’s bill, which will go into effect on January 1, 2026, are discussed in further detail below.

• Changes to the Definition of Personal Information.  Similar to other state data breach notification laws, Oklahoma’s existing law requires notification to state residents following a “breach” of unencrypted computerized data that includes personal information.  The bill will expand the definition of personal information to include, among other data elements, an individual’s name in combination with (1) “other unique identification numbers” that are “created or collected by a government entity”; (2) “unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual’s financial account”; or (3) “unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual.”
• New Regulator Notification Requirement.  Once the bill’s changes become effective, Oklahoma will require entities to notify the Attorney General of breaches involving 500 or more residents.  The threshold is higher—1,000 or more residents—for breaches of credit bureau security systems.  Notice to the Attorney General must be provided no more than 60 days after providing notice to individual residents (which must be made “without unreasonable delay,” subject to exceptions), and the notice to the Attorney General must include:
  •  the date of the breach;
  • the date of the breach determination;
  • the nature of the breach;
  • the type of personal information exposed;
  • the number of Oklahoma residents affected;
  • the estimated monetary impact of the breach (if it can be determined); and
  • any “reasonable safeguards” the entity employs (defined as discussed below).
• New Sector-Specific Notification Safe Harbors.  The bill expands Oklahoma’s sector-specific safe harbor provisions to deem entities that are compliant with the Gramm-Leach-Bliley Act (GLBA), the Oklahoma Hospital Cybersecurity Protection Act, and/or the Health Insurance Portability and Accountability Act (HIPAA), as compliant with Oklahoma’s individual notification requirements as long as the entities provide any required notice to the Attorney General.
• Affirmative Defense for “Reasonable Safeguards.”  While Oklahoma’s existing data breach notification law provides for civil penalties of up to $150,000 per breach for violations of the law, the bill states that entities that use “reasonable safeguards” and provide notice in accordance with the statute will not be subject to civil penalties and can use such compliance as an affirmative defense in civil actions filed under the statute.  Reasonable safeguards are defined as “policies and practices that ensure personal information is secure, taking into consideration an entity’s size and the type and amount of personal information.”  (This affirmative defense could be construed narrowly, since it may be challenging to demonstrate that safeguards are “reasonable” where they must “ensure personal information is secure[.]”)  Further, the bill states that the term includes, but is not limited to, “conducting risk assessments, implementing technical and physical layered defenses, employee training on handling personal information, and establishing an incident response plan.”  If an entity fails to use reasonable safeguards but provides notice in accordance with the law, civil penalties will be capped at $75,000 plus actual damages.