Data Breach Notice to Residents and State Authorities in Oklahoma
At a glance
| Covered entity and service provider | Owner or licensee of computerized PI notifies residents; nonowner maintainer tells owner/licensee as soon as practicable after determination (§ 163(A),(C)) |
|---|---|
| Breach and covered information | Unauthorized access AND acquisition of unencrypted/unredacted computerized PI; name plus ID, financial-access, or biometric data; compromised keys can count (§§ 162(1),(6), 163(A)-(B)) |
| Risk screen or notice exception | Breach requires actual or reasonably believed identity theft or other fraud; good-faith employee acquisition excluded if no improper use/disclosure (§ 162(1)) |
| Individuals who receive notice | Oklahoma residents whose PI was or reasonably is believed accessed and acquired by an unauthorized person after a qualifying breach (§ 163(A)-(B)) |
| Individual notice deadline and clock | Without unreasonable delay after determination or notification; scope and system-restoration work may precede notice; no fixed outer day count (§ 163(A)) |
| Regulator threshold and deadline | AG at 500 affected Oklahoma residents (1,000 for credit bureaus); without unreasonable delay, no later than 60 days after resident notice; specified incident report (§ 163(E)) |
| Consumer-reporting-agency notice | No separate nationwide consumer-reporting-agency notice in this Act; a credit bureau instead has a 1,000-resident AG-report threshold (§§ 162-166, 163(E)(3)) |
| Individual delivery and content | Postal writing, telephone, or electronic notice; Act specifies AG report fields but no itemized resident-letter fields (§§ 162(7), 163(A),(E)) |
| Substitute notice conditions and channels | Cost over $50,000, affected class over 100,000, or insufficient contacts/consent: any TWO of email if available, website if maintained, statewide media (§ 162(7)(d)) |
| Delays and alternate compliance | Law-enforcement impediment or security delay; timely own-policy route or qualifying regulated-entity route, with applicable AG report retained (§§ 163(A),(D), 164) |
Requirements one by one
The breach and covered information
Under 24 O.S. § 162(1), a breach involves unauthorized access and acquisition of unencrypted and unredacted computerized personal information in a database concerning multiple people. It must cause, or reasonably be believed to cause, identity theft or other fraud against an Oklahoma resident. Good-faith employee or agent acquisition for the holder is excluded if there is no improper use or unauthorized disclosure.
Under 24 O.S. § 162(6), covered data includes a name with a Social Security number; a driver's license or other government identification number; financial account access data; or biometric data used to authenticate someone. Publicly available information is excluded. Section 163(B) addresses data exposed in readable form or a breach involving access to an encryption key.
Resident and Attorney General notice
The owner or licensee must notify affected residents without unreasonable delay after determination or notification of the breach under § 163(A). The law permits time to determine scope and restore reasonable system integrity; it sets no fixed outer day count for resident notice. A nonowner maintainer tells the owner or licensee as soon as practicable following determination under subsection (C).
Section 163(E) adds an Attorney General report when a single breach affects 500 or more Oklahoma residents, or 1,000 or more for a credit bureau. That report is due without unreasonable delay and no later than 60 days after resident notice. It gives the breach and determination dates, nature, data types, affected-resident count, estimated monetary impact if determinable, and reasonable safeguards. This Act does not prescribe a separate nationwide consumer-reporting-agency report or an itemized resident-letter checklist.
Delivery and substitute notice
Under § 162(7), notice may be postal writing, telephone, or electronic. If direct notice would cost more than $50,000, the affected class exceeds 100,000, or sufficient contact information or consent is lacking, substitute notice uses any two of email where addresses exist, a conspicuous website posting where the entity has a public site, and major statewide media.
What trips people up
The amended rule turns on a 2026 determination or notification. Section 166 makes the current Act applicable when that event occurs on or after January 1, 2026. The underlying incident date alone does not answer which version applies.
A police delay requires agency action. Under § 163(D), law enforcement must determine and advise that notice would impede a criminal or civil investigation or homeland or national security. Notice resumes without unreasonable delay after the agency determines the impediment has ended.
Alternative compliance does not erase every AG report. Section 164(A) recognizes a holder's own notification policy if it meets the statutory timing and the holder follows it. Section 164(B) recognizes specified financial, health, and federally regulated notice routes only if the entity gives the applicable § 163(E) Attorney General report.
Common questions
Does unauthorized access by itself trigger notice?
No. The definition in § 162(1) requires access and acquisition, plus actual or reasonably believed identity theft or other fraud.
Is the Attorney General's 60-day period measured from discovery?
No. Section 163(E)(1) measures its outside limit from the date affected residents are notified.
Statutes and sources
- 24 O.S. § 162 — definitions and notice methods.
- 24 O.S. § 163 — resident, owner, and Attorney General notice.
- 24 O.S. § 164 — alternate compliance.
- 24 O.S. § 166 — application date.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Oklahoma law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Oklahoma law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace