PRIA Logo™
OklahomaSB 626Oklahoma 2026 Regular SessionSenate

Security Breach Notification Act; requiring notice of security breach of certain information; modifying provisions. Effective date.

Sponsored By: Brent Howard (Republican)

Became Law

Senate Committee

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

3 provisions identified: 0 benefits, 0 costs, 3 mixed.

Broader Oklahoma breach notices with limits

The law takes effect January 1, 2026, and applies to breaches occurring on or after that date. Covered data combines a person's first name or first initial and last name with listed sensitive information. This includes Social Security numbers, driver's license numbers, other listed government IDs, and biometric data. Financial account numbers, card numbers, electronic identifiers, and routing codes qualify when paired with required security information. Encrypted or altered data counts when the breach also exposes the keys needed to read it; lawfully public information is excluded. Notice is required when access to covered data causes, or is reasonably believed to cause, identity theft or fraud. Breaches affecting fewer than 500 Oklahoma residents are exempt; credit reporting agencies have a 1,000-resident threshold. Required notice must come without unreasonable delay, subject to law-enforcement protections. Entities must notify the Oklahoma Attorney General within 60 days after notifying residents. That report includes breach and discovery dates, the breach's nature, exposed data types, affected resident count, estimated financial impact, and safeguards. Reports to the Attorney General receive confidentiality protections.

Alternative breach notice rules for entities

For breaches on or after January 1, 2026, entities can meet notice requirements through their own privacy or security policies. Those procedures must meet the law's timing requirements and notify affected Oklahoma residents. Financial institutions can instead follow the Gramm-Leach-Bliley Act and related federal customer-notice guidance. Health entities can follow the Oklahoma Hospital Cybersecurity Protection Act of 2023 or federal health privacy rules under HIPAA. Entities can also follow applicable notice requirements from their primary or functional federal regulator. Entities using these institutional alternatives must still provide the required notice to the Oklahoma Attorney General.

Breach penalties with protections for entities

For breaches on or after January 1, 2026, Oklahoma prosecutors can enforce violations that cause residents injury or loss. The Attorney General or a district attorney can seek actual damages and civil penalties under Oklahoma's consumer protection law. Penalties reach $150,000 per breach, or per series of similar breaches found in one investigation. Penalties depend on the breach's size, the entity's conduct, and whether required notice was given. Entities using reasonable safeguards and giving required notice avoid civil penalties and can use compliance as a defense. Safeguards must fit the entity's size and the type and amount of data it holds. Entities without reasonable safeguards that give required notice face actual damages and a $75,000 civil penalty. For state-chartered or state-licensed financial institutions, only the primary state regulator can enforce the breach-notice law.

Sponsors & Cosponsors

Sponsor

  • Brent Howard

    Republican • Senate

Cosponsors

  • John Pfeiffer

    Republican • House

Roll Call Votes

All Roll Calls

Yes: 197 • No: 17

Senate vote • 5/20/2025

FOURTH READING

Yes: 36 • No: 6

House vote • 5/7/2025

THIRD READING

Yes: 85 • No: 2

House vote • 4/16/2025

DO PASS

Yes: 27 • No: 0

House vote • 4/7/2025

DO PASS

Yes: 6 • No: 1

Senate vote • 3/27/2025

THIRD READING

Yes: 38 • No: 6

Senate vote • 2/13/2025

Committee vote: Technology & Telecommunications

Yes: 5 • No: 2

Actions Timeline

  1. Becomes law without Governor's signature 05/28/2025

    5/28/2025Senate

  2. Sent to Governor

    5/21/2025Senate

  3. Signed, returned to Senate

    5/21/2025House

  4. Enrolled, to House

    5/21/2025Senate

  5. Referred for enrollment

    5/20/2025Senate

  6. Measure passed: Ayes: 36 Nays: 6

    5/20/2025Senate

  7. HAs adopted

    5/20/2025Senate

  8. HAs read

    5/8/2025Senate

  9. Engrossed, signed, to Senate

    5/8/2025House

  10. Referred for engrossment

    5/7/2025House

  11. Third Reading, Measure passed: Ayes: 85 Nays: 2

    5/7/2025House

  12. Amended

    5/7/2025House

  13. General Order

    5/7/2025House

  14. CR; Do Pass Appropriations and Budget Committee

    4/17/2025House

  15. Recommendation to the full committee; Do Pass Appropriations and Budget Judiciary Subcommittee

    4/8/2025House

  16. Referred to Appropriations and Budget Judiciary Subcommittee

    4/2/2025House

  17. Second Reading referred to Appropriations and Budget

    4/1/2025House

  18. First Reading

    3/31/2025House

  19. Engrossed to House

    3/31/2025Senate

  20. Referred for engrossment

    3/27/2025Senate

  21. Measure passed: Ayes: 38 Nays: 6

    3/27/2025Senate

  22. General Order, Amended

    3/27/2025Senate

  23. Coauthored by Representative Pfeiffer (principal House author)

    2/24/2025Senate

  24. Placed on General Order

    2/19/2025Senate

  25. Reported Do Pass Technology and Telecommunications committee; CR filed

    2/13/2025Senate

Bill Text

  • Enrolled (final version)

    5/21/2025

    PDF

  • Amended And Engrossed

    5/8/2025

    PDF

  • Floor (House)

    4/21/2025

    PDF

  • House Committee Report

    4/17/2025

    PDF

  • House Committee Report

    4/8/2025

    PDF

  • Engrossed

    3/31/2025

    PDF

  • Floor (Senate)

    2/17/2025

    PDF

  • Senate Committee Report

    2/13/2025

    PDF

  • Introduced

    1/14/2025

    PDF

Related Bills

Back to State Legislation