---
title: "Oklahoma privacy law: applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/oklahoma/applicability"
source: "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title)

# Oklahoma privacy law: applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The act applies to controllers and processors that do business in Oklahoma or target products or services to its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. State agencies and political subdivisions (and their service providers), GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and institutions of higher education are excluded at entity level. 'Consumer' excludes people acting in a commercial or employment context, and employment-related data is exempt.

## Key points

1. Threshold: personal data of at least 100,000 consumers in a calendar year.

   Section: [SB 546 § 15(A)(2)(a) (75A O.S. § 314)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

2. Data-seller threshold: at least 25,000 consumers and over 50% of gross revenue from selling personal data.

   Section: [SB 546 § 15(A)(2)(b) (75A O.S. § 314)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

3. Entity-level exclusion for financial institutions and for data subject to Title V of GLBA.

   Section: [SB 546 § 15(B)(2) (75A O.S. § 314)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

4. Entity-level exclusion for HIPAA covered entities and business associates; health records and other health data are also exempt.

   Section: [SB 546 § 15(B)(3); § 16 (75A O.S. §§ 314, 315)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

5. Nonprofits (broadly defined, including political organizations) and institutions of higher education are excluded.

   Section: [SB 546 § 1(18); § 15(B)(4), (5) (75A O.S. §§ 300, 314)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

6. Employment, emergency-contact and benefits data are exempt, as are FCRA, DPPA, FERPA and Farm Credit Act data.

   Section: [SB 546 § 16(11) to (17) (75A O.S. § 315)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

7. 'Sale' covers only exchanges for monetary consideration.

   Section: [SB 546 § 1(28) (75A O.S. § 300)](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

## Sources

- [Enrolled Senate Bill 546 (2025-2026), full text](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Oklahoma statute](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf)

Reference material, not legal advice.

## Other topics for Oklahoma

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/oklahoma/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/oklahoma/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/oklahoma/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/oklahoma/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/oklahoma/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oklahoma](https://dposchool.com/state-privacy-laws/state/oklahoma) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/oklahoma/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents