Oklahoma's Privacy Law Starts January 1. Can You Find Your Customer Data?

A law with a date on it

Governor Kevin Stitt approved Senate Bill 546 on March 20, 2026, giving Oklahoma a consumer data privacy law of its own. The Oklahoma House announced it as signed into law three days later, authored by Representative Josh West of Grove and Senator Brent Howard of Altus. The enrolled text sets its effective date plainly: January 1, 2027. For a company that falls under it, that leaves roughly ten weeks from today, and most of what the law asks for cannot be produced in the final week of December.

The law is written around requests. A customer can ask what you hold about them, ask you to fix it, ask you to delete it, or ask for a copy they can take elsewhere, and you have a clock to answer. Each of those requests assumes something many Oklahoma companies have never had to prove: that someone inside the business can find every place a given customer's personal data is stored, across the CRM, the billing system, the marketing platform, the shared drives, and the spreadsheet a sales manager exported two years ago.

Who the law covers

Senate Bill 546 applies to a business that operates in Oklahoma or offers products or services to Oklahoma residents and that, during a calendar year, controls or processes the personal data of at least 100,000 Oklahoma consumers, or of at least 25,000 consumers while deriving more than 50 percent of its gross revenue from selling personal data. A consumer means an Oklahoma resident acting in an individual or household context. People acting in a commercial or employment context are excluded, and employee and job applicant data is exempt.

The exemptions matter in this state. State agencies and political subdivisions are outside the law, as are financial institutions and data covered by the Gramm Leach Bliley Act, entities and business associates covered by HIPAA, nonprofit organizations, and institutions of higher education. Banks, hospitals, and universities that fall under those exemptions will keep answering to the rules they already follow. The companies left in scope are typically consumer facing businesses with large customer lists, such as retailers, ecommerce operations, telecom providers, and service companies.

What a covered company owes, in data terms

• Answer consumer requests to confirm, access, correct, delete, or receive a portable copy of their personal data within 45 days, with one 45 day extension when reasonably necessary, free of charge up to twice a year per consumer
• Honor opt outs from targeted advertising, the sale of personal data, and profiling used for decisions that produce legal or similarly significant effects
• Offer two or more secure and reliable ways to submit a request, without forcing a consumer to create a new account, and provide a request mechanism on your website
• Decide appeals of denied requests within 60 days, and tell a consumer whose appeal is denied how to contact the Attorney General
• Publish a clear privacy notice listing the categories of personal data you process, why you process it, how consumers exercise their rights, and the categories of data and third parties you share with
• Collect only data that is adequate, relevant, and reasonably necessary for the purposes you disclose, protect it with reasonable security practices, and get consent before processing sensitive data
• Put written contracts in place with every processor, covering instructions, the type of data, the duration of processing, confidentiality, deletion or return of data, and subcontractors
• Conduct and document data protection assessments for targeted advertising, the sale of data, risky profiling, and any processing of sensitive data

Read that list as a data team would and a pattern appears. Access, correction, deletion, and portability all require locating one person's records across every system. The privacy notice requires an accurate list of data categories and the parties you share them with. Processor contracts require knowing who your processors are. Assessments require knowing which processing activities touch sensitive data. None of it works without an inventory.

The breach law already changed

Senate Bill 546 is not the only new obligation. Senate Bill 626, which became law in 2025 without the Governor's signature, rewrote Oklahoma's Security Breach Notification Act effective January 1, 2026. When a breach requires notice to Oklahoma residents and affects 500 or more of them, the company must also notify the Attorney General within 60 days of notifying residents, reporting the type of personal information exposed, the number of residents affected, and the reasonable safeguards it uses. The Attorney General or a district attorney can seek actual damages and a civil penalty of up to $150,000 per breach.

The amendment also rewards preparation. A company that uses reasonable safeguards and provides the required notice is not subject to civil penalties and can use that compliance as an affirmative defense. A company that gives notice but lacks reasonable safeguards faces actual damages and a $75,000 civil penalty. The statute describes reasonable safeguards as including risk assessments, technical and physical layered defenses, employee training on handling personal information, and an incident response plan. The privacy law then ties the two together: processors must help controllers meet their duties under the breach notification act.

Where to start before January 1

Ten weeks is enough to build a working foundation if the work goes in the right order. Start with the data, because every legal document downstream depends on it.

1. 1Confirm whether you are in scope: count the unique Oklahoma consumers in your customer, marketing, and transaction data for a calendar year, and check whether an exemption applies to your company or to specific data sets
2. 2Build the inventory: list every system, database, file share, and export that holds consumer personal data, with the categories it holds, the owner, and how long it is kept
3. 3Map the flows: record which vendors and platforms receive personal data from you, which act as your processors, and where data is sold or used for targeted advertising
4. 4Flag sensitive data: search for the categories the law treats as sensitive, including precise location, health details, and biometrics, and confirm you have consent or stop collecting it
5. 5Make requests answerable: define how a request is received and verified, which systems are searched, who approves deletion, and how a response is logged, then test it on a sample record before the 45 day clock is real
6. 6Close the gaps: delete data you no longer need, update processor contracts, and document the safeguards the breach law expects, so legal counsel can finish the notice and assessments on accurate facts

This order keeps companies out of two common traps. The first is publishing a privacy notice copied from a template that does not match what the business actually collects. The second is promising consumers a deletion process that only reaches the main database while copies sit untouched in reporting tables, backups of exports, and marketing lists. Both are data problems that a legal review alone will not find.

What this means if you run a company in Oklahoma

Enforcement belongs to the Attorney General alone. There is no private right of action, and before suing the Attorney General must give written notice and 30 days to cure. After that, penalties run up to $7,500 for each violation. A cure period is useful only to a company that can find and fix the problem within 30 days, which brings the question back to the inventory. Data protection assessments are confidential, can be requested by the Attorney General through a civil investigative demand, and apply to processing activities that begin on or after January 1, 2027, so a new marketing program or data sharing arrangement launched next year will need one from the start. This is not legal advice, and covered companies should confirm their obligations with counsel. Counsel will work faster, and at lower cost, from an accurate map of your data than from a blank page.

At Oklahoma Data Partners, this is the data foundation work we do every day: inventorying the databases, platforms, and files where personal data actually lives, mapping how it moves between systems and vendors, cleaning up what should not be kept, and building the search and reporting that let a team answer a request with confidence. If you are not sure whether the new law covers you, or you cannot yet say where your customer data lives, book a consultation and we will help you build the inventory before January 1.