Cybersecurity Policy Report, Oklahoma Data Breach Notification Bill Becomes Law, (May 29, 2025)
A new Oklahoma state law will require entities experiencing a data breach to notify the state attorney general of the breach within 60 days after providing notice to impacted residents. The new law takes effect Jan. 1, 2026.
SB 626 modifies the Security Breach Notification Act and requires entities to notify the attorney general within 60 days of notifying affected residents of a security breach, with exemptions for breaches affecting fewer than 500 residents or 1,000 residents in the case of credit bureaus.
According to the law, the notice should include the date of the breach, the date of its determination, the nature of the breach, the type of personal information exposed, the number of state residents affected, the estimated monetary impact of the breach to the extent such impact can be determined, and any reasonable safeguards the entity employs.
The bill (S.B. 626, Reg Sess.) was sponsored by Sen. Brent Howard (R.).
News: StateLegislation DataBreach DataSecurity