Data breach notification
Oklahoma's Security Breach Notification Act, Okla. Stat. tit. 24, §§ 161-166, was amended by 2025 SB 626, which took effect January 1, 2026.
This page was checked against the enrolled SB 626 on the Legislature's server; the bill became law without the Governor's signature on May 28, 2025.
A business must notify the Attorney General without unreasonable delay, and in no event more than sixty days after it notifies impacted residents. A breach affecting fewer than five hundred residents within a single breach is exempt from that requirement. For a credit bureau the floor is one thousand residents.
The disclosure to residents shall be made without unreasonable delay. No day count is set for residents, while the Attorney General's notice is counted from the resident notice.
The duty runs to residents whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person. It also needs a consequence: the breach causes, or the business reasonably believes it has caused or will cause, identity theft or other fraud to a resident.
The amended definition pairs a first name or initial and last name with any of the following.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
The watermark is a per-room setting that ships switched on. Readers confirm their email with a six-digit code and need no account; each group sees its own folders. Because the log is chained and exports as CSV, an Oklahoma team can tell quickly whether a file kept in ShareAndGo was opened by 40 people or 600.
The enrolled bill prints struck and inserted words side by side, and a compiled 2026 Title 24 was not available on an official site to cross-check, so this page keeps to the points the bill states plainly.
Checked against Oklahoma's enrolled SB 626 of 2025 on November 2, 2026. This is general information, not legal advice.
