{"data":{"id":"us-ok/okla.-stat.-tit.-24-24-162","jurisdiction":"us-ok","citation":"Okla. Stat. tit. 24, § 24-162","heading":"Definitions","body":"As used in the Security Breach Notification Act:\n\n1. “Breach of the security of a system” means the unauthorized\n\naccess and acquisition of unencrypted and unredacted computerized\n\ndata that compromises the security or confidentiality of personal\n\ninformation maintained by an individual or entity as part of a\n\ndatabase of personal information regarding multiple individuals and\n\nthat causes, or the individual or entity reasonably believes has\n\ncaused or will cause, identity theft or other fraud to any resident\n\nof this state. Good faith acquisition of personal information by an\n\nemployee or agent of an individual or entity for the purposes of the\n\nindividual or the entity is not a breach of the security of the\n\nsystem, provided that the personal information is not used for a\n\npurpose other than a lawful purpose of the individual or entity or\n\nsubject to unauthorized disclosure;\n\n2. “Entity” includes corporations, business trusts, estates,\n\npartnerships, limited partnerships, limited liability partnerships,\n\nlimited liability companies, associations, organizations, joint\n\nventures, governments, governmental subdivisions, agencies, or\n\ninstrumentalities, or any other legal entity, whether for profit or\n\nnot-for-profit;\n\n3. “Encrypted” means transformation of data through the use of\n\nan algorithmic process into a form in which there is a low\n\nprobability of assigning meaning without use of a confidential\n\nprocess or key, or securing the information by another method that\n\nrenders the data elements unreadable or unusable;\n\n4. “Financial institution” means any institution the business\n\nof which is engaging in financial activities as defined by 15\n\nU.S.C., Section 6809;\n\n5. “Individual” means a natural person;\n\n6. “Personal information” means an individual’s first name or\n\nfirst initial and last name in combination with any one or more of\n\nthe following data elements that relate to the individual if any of\n\nthe data elements are not encrypted, redacted, or otherwise altered\n\nby any method or technology in such a manner that the name or data\n\nelements are unreadable or are encrypted, redacted, or otherwise\n\naltered by any method or technology but the keys to unencrypt,\n\nunredact, or otherwise read the data elements have been obtained\n\nthrough the breach of security:\n\na. social security number,\n\nb. driver license number or other unique identification\n\nnumber created or collected by a government entity,\n\nc. financial account number, or credit card or debit card\n\nnumber, in combination with any required expiration\n\ndate, security code, access code, or password that\n\nwould permit access to an individual’s financial\n\naccount,\n\nd. unique electronic identifier or routing code in\n\ncombination with any required security code, access\n\ncode, or password that would permit access to an\n\nindividual’s financial account, or\n\ne. unique biometric data such as a fingerprint, retina or\n\niris image, or other unique physical or digital\n\nrepresentation of biometric data to authenticate a\n\nspecific individual.\n\nThe term does not include information that is lawfully obtained from\n\npublicly available sources, or from federal, state or local\n\ngovernment records lawfully made available to the general public;\n\n7. “Notice” means:\n\na. written notice to the postal address in the records of\n\nthe individual or entity,\n\nb. telephone notice,\n\nc. electronic notice, or\n\nd. substitute notice, if the individual or the entity\n\nrequired to provide notice demonstrates that the cost\n\nof providing notice will exceed Fifty Thousand Dollars\n\n($50,000.00), or that the affected class of residents\n\nto be notified exceeds one hundred thousand (100,000)\n\npersons, or that the individual or the entity does not\n\nhave sufficient contact information or consent to\n\nprovide notice as described in subparagraph a, b, or c\n\nof this paragraph. Substitute notice consists of any\nousand Dollars\n\n($50,000.00), or that the affected class of residents\n\nto be notified exceeds one hundred thousand (100,000)\n\npersons, or that the individual or the entity does not\n\nhave sufficient contact information or consent to\n\nprovide notice as described in subparagraph a, b, or c\n\nof this paragraph. Substitute notice consists of any\n\ntwo of the following:\n\n(1) email notice if the individual or the entity has\n\nemail addresses for the members of the affected\n\nclass of residents,\n\n(2) conspicuous posting of the notice on the Internet\n\nwebsite of the individual or the entity if the\n\nindividual or the entity maintains a public\n\nInternet website, or\n\n(3) notice to major statewide media;\n\n8. “Reasonable safeguards” means policies and practices that\n\nensure personal information is secure, taking into consideration an\n\nentity’s size and the type and amount of personal information. The\n\nterm includes, but is not limited to, conducting risk assessments,\n\nimplementing technical and physical layered defenses, employee\n\ntraining on handling personal information, and establishing an\n\nincident response plan; and\n\n9. “Redact” means alteration or truncation of data such that no\n\nmore than the following are accessible as part of the personal\n\ninformation:\n\na. five digits of a social security number, or\n\nb. the last four digits of a driver license number,\n\nunique identification number created or collected by a\n\ngovernment entity, or account number.","path":["OK Code","Title 24"],"source_url":"https://www.oklegislature.gov/OK_Statutes/CompleteTitles/os24.pdf","current_through":"2026-08-14","vintage":"open-us-law v2026.08, retrieved 2026-09-14","retrieved_at":"2026-09-14T18:32:36Z","sha256":"1f86b503d0cba84a3bb9be4897b8b689cb5f6e8dadf35e3146f27065bc8fa2a5","source_id":"us-ok","stale":false,"prev":"us-ok/okla.-stat.-tit.-24-24-161","next":"us-ok/okla.-stat.-tit.-24-24-163"},"notice":"GroundRules: Original legal text. Not legal advice."}