{"data":{"id":"us-ok/okla.-stat.-tit.-74-74-3113.1","jurisdiction":"us-ok","citation":"Okla. Stat. tit. 74, § 74-3113.1","heading":"Disclosure of breach of security of computerized","body":"personal information.\n\nA. Any state agency, board, commission or other unit or\n\nsubdivision of state government that owns or licenses computerized\n\ndata that includes personal information shall disclose any breach of\n\nthe security of the system following discovery or notification of\n\nthe breach in the security of the data to any resident of Oklahoma\n\nwhose unencrypted personal information was, or is reasonably\n\nbelieved to have been, acquired by an unauthorized person. The\n\ndisclosure shall be made in the most expedient time possible and\n\nwithout unreasonable delay, consistent with the legitimate needs of\n\nlaw enforcement, as provided in subsection C of this section, or any\n\nmeasures necessary to determine the scope of the breach and restore\n\nthe reasonable integrity of the data system.\n\nB. Any state agency, board, commission or other unit or\n\nsubdivision of state government that maintains computerized data\n\nthat includes personal information that the state agency, board,\n\ncommission or other unit or subdivision of state government does not\n\nown shall notify the owner or licensee of the information of any\n\nbreach of the security of the data immediately following discovery,\n\nif the personal information was, or is reasonably believed to have\n\nbeen, acquired by an unauthorized person.\n\nC. The notification required by this section may be delayed if\n\na law enforcement agency determines that the notification will\n\nimpede a criminal investigation. The notification required by this\n\nsection shall be made after the law enforcement agency determines\n\nthat it will not compromise the investigation.\n\nD. As used in this section:\n\n1. “Breach of the security of the system” means unauthorized\n\nacquisition of computerized data that compromises the security,\n\nconfidentiality, or integrity of personal information maintained by\n\nthe state agency, board, commission or other unit or subdivision of\n\nstate government. Good faith acquisition of personal information by\n\nan employee or agent of the state agency, board, commission or other\n\nunit or subdivision of state government for the purposes of that\n\nentity shall not be a breach of the security of the system, provided\n\nthat the personal information is not used or subject to further\n\nunauthorized disclosure;\n\n2. “Personal information” means the first name or first initial\n\nand last name of an individual in combination with any one or more\n\nof the following data elements, when either the name or the data\n\nelements are not encrypted:\n\na. social security number,\n\nb. driver license number, or\n\nc. account number, credit or debit card number, in\n\ncombination with any required security code, access\n\ncode, or password that would permit access to the\n\nfinancial account of an individual.\n\nPersonal information shall not include publicly available\n\ninformation that is lawfully made available to the general public\n\nfrom federal, state, or local public records; and\n\n3. “Notice” means one of the following methods:\n\na. written notice,\n\nb. electronic notice, if the notice provided is\n\nconsistent with the provisions regarding electronic\n\nrecords and signatures set forth in Section 7001 of\n\nTitle 15 of the United States Code, and\n\nc. substitute notice, if the agency demonstrates that the\n\ncost of providing notice would exceed Two Hundred\n\nFifty Thousand Dollars ($250,000.00), or that the\n\naffected class of subject persons to be notified\n\nexceeds five hundred thousand (500,000), or the agency\n\ndoes not have sufficient contact information.\n\nSubstitute notice shall consist of all of the\n\nfollowing:\n\n(1) e-mail notice when the agency has an e-mail\n\naddress for the subject persons,\n\n(2) conspicuous posting of the notice on the agency’s\n\nweb site page, if the agency maintains one, and\ne\n\naffected class of subject persons to be notified\n\nexceeds five hundred thousand (500,000), or the agency\n\ndoes not have sufficient contact information.\n\nSubstitute notice shall consist of all of the\n\nfollowing:\n\n(1) e-mail notice when the agency has an e-mail\n\naddress for the subject persons,\n\n(2) conspicuous posting of the notice on the agency’s\n\nweb site page, if the agency maintains one, and\n\n(3) notification to major statewide media.\n\nE. Notwithstanding paragraph 3 of subsection D of this section,\n\na state agency, board, commission or other unit or subdivision of\n\nstate government that maintains its own notification procedures as\n\npart of an information security policy for the treatment of personal\n\ninformation and is otherwise consistent with the timing requirements\n\nof this section shall be deemed to be in compliance with the\n\nnotification requirements of this section if it notifies subject\n\npersons in accordance with its policies in the event of a breach of\n\nsecurity of the system.","path":["OK Code","Title 74"],"source_url":"https://www.oklegislature.gov/OK_Statutes/CompleteTitles/os74.pdf","current_through":"2026-08-14","vintage":"open-us-law v2026.08, retrieved 2026-09-14","retrieved_at":"2026-09-14T18:32:36Z","sha256":"06d0c9c25a8449272e61a3898e7d52d7196a8d24af05c7f50d3633f6a7f19688","source_id":"us-ok","stale":false,"prev":"us-ok/okla.-stat.-tit.-74-74-3113","next":"us-ok/okla.-stat.-tit.-74-74-3114"},"notice":"GroundRules: Original legal text. Not legal advice."}