--- title: "Oklahoma privacy law: overview" canonical: "https://dposchool.com/state-privacy-laws/state/oklahoma" source: "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Comprehensive state privacy law # Oklahoma privacy law Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title) Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) - **Citation:** Okla. Stat. tit. 75A, §§ 300 to 320 (to be codified by SB 546 (2026), Secs. 1 to 21) - **Official text:** https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf - **Enacted:** March 20, 2026. [Enrolled SB 546, 60th Legislature (2025-2026); introduced 3 February 2025, passed the Senate 26 March 2025, passed the House as amended 19 February 2026, final Senate passage 16 March 2026, approved by the Governor 20 March 2026](http://www.oklegislature.gov/BillInfo.aspx?Bill=SB546&Session=2600) - **In force:** Enacted, in force January 1, 2027 - **Effective dates:** - **January 1, 2027:** whole act (Sec. 22) - **January 1, 2027:** data protection assessments apply only to processing activities that begin on or after this date (Sec. 10(G)) - **Enforcer:** Attorney General (exclusive) - **Private right of action:** No. The act expressly provides no basis for a private right of action (Sec. 14(E)). - **Cure period:** 30 days. The Attorney General must give 30 days' written notice; no action may be brought if the violation is cured and a written statement with supporting documentation and an assurance of no further violations is given. The cure period does not expire. (SB 546 § 13 (75A O.S. § 312)) - **Rulemaking:** No. No rulemaking power. The Attorney General must post information on controller and processor duties and consumer rights, and an online complaint mechanism (Sec. 12(B)). ## Amendments No amendments recorded. ## Topics - [Applicability](https://dposchool.com/state-privacy-laws/state/oklahoma/applicability): The act applies to controllers and processors that do business in Oklahoma or target products or services to its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. State agencies and political subdivisions (and their service providers), GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and institutions of higher education are excluded at entity level. 'Consumer' excludes people acting in a commercial or employment context, and employment-related data is exempt. - [Consumer rights](https://dposchool.com/state-privacy-laws/state/oklahoma/consumer-rights): Consumers may confirm processing and access their data, correct it, delete it, obtain a portable copy of data they provided (if held digitally), and opt out of targeted advertising, sale and profiling for decisions with legal or similarly significant effects. Controllers must respond within 45 days, extendable once by 45 days with notice, and must offer an appeal answered in writing within 60 days. Responses are free up to twice a year, and controllers must offer at least two request methods. - [Sensitive data](https://dposchool.com/state-privacy-laws/state/oklahoma/sensitive-data): Controllers may not process sensitive data without the consumer's consent, and a known child's sensitive data must be processed under COPPA. Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for unique identification, data collected from a known child (under 13), and precise geolocation within 1,750 feet. The act sets no special rule for teenagers. - [Controller duties](https://dposchool.com/state-privacy-laws/state/oklahoma/controller-duties): Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and get consent for incompatible new purposes. They must publish a clear privacy notice and, if they sell data or use it for targeted advertising, disclose this and how to opt out. Data protection assessments are required for targeted advertising, sales, risky profiling, sensitive data and other high-risk processing. The act contains no duty to honour universal opt-out signals. - [Processors](https://dposchool.com/state-privacy-laws/state/oklahoma/processors): Processors must follow controller instructions and help with consumer requests, security and breach notification, and assessments. A contract must set clear instructions, nature and purpose, data types, duration and both parties' rights and obligations. It must also require confidentiality, deletion or return at the end, compliance information, cooperation with assessments (or an independent assessment), and written flow-down contracts with subcontractors. - [Enforcement](https://dposchool.com/state-privacy-laws/state/oklahoma/enforcement): The Attorney General has exclusive enforcement authority and there is no private right of action. Before suing, the Attorney General must give 30 days' written notice, and no action may follow if the violation is cured and a written statement with supporting documentation is given; this cure right does not expire. Violations after the cure period, or breach of the written statement, carry civil penalties of up to $7,500 per violation, plus injunctions and attorney fees. ## Sources - [Enrolled Senate Bill 546 (2025-2026), full text](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) - [Oklahoma Legislature bill information, SB 546 (history: approved by Governor 03/20/2026)](http://www.oklegislature.gov/BillInfo.aspx?Bill=SB546&Session=2600) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Oklahoma statute](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf) Reference material, not legal advice. ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Oklahoma Previous: [Louisiana](https://dposchool.com/state-privacy-laws/state/louisiana) Next: [Alabama](https://dposchool.com/state-privacy-laws/state/alabama) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents