Oklahoma Implements Robust Consumer Data Privacy Law SB 546
Oklahoma has become the 21st state in the United States to implement a rigorous consumer data privacy statute, marked by the signing of SB 546 into law by Governor Kevin Stitt on March 20, 2026. This legislation aligns closely with the business-friendly privacy frameworks seen in Virginia and Tennessee, providing structured guidelines for managing personal data for companies already adhering to other state privacy laws.
The new law, effective January 1, 2027, applies to businesses operating within Oklahoma or targeting its residents. The term "consumer" refers to individuals residing in Oklahoma in a personal capacity, intentionally excluding data related to commercial or employment activities, thus mirroring other state privacy statutes with the exception of California’s broader scope.
Under this Act, businesses encounter distinct entity-level and data-specific exemptions. The legislation categorizes entities as "controllers," which determine data processing purposes and means, and "processors," which handle data on behalf of controllers. Processors are bound by stringent contract obligations ensuring confidentiality and compliance, with requirements for data return or deletion post-use and oversight of subprocessors.
Consumer Rights and Business Obligations
Controllers must ensure the collected personal data’s relevance and necessity for disclosed purposes, needing explicit consumer consent for any processing beyond these purposes. The Act offers structured exemptions for pseudonymous data, allowing exclusions from some consumer rights if technical measures prevent personal identification.
Consumer rights under the Act include access, rectification, deletion of personal data, and obtaining data in a portable format. Controller obligations include transparent consumer rights communication and response to data requests within 45 days, with a potential 45-day extension, and a mandatory appeal process for denied requests.
Businesses are mandated to present transparent privacy notices, requiring unambiguous consumer consent free from manipulative "dark patterns." The regulation imposes stricter consent requirements for "sensitive data," with heightened specifications for children's data under the Children’s Online Privacy Protection Rule. The definition of "sale" is limited to monetary transactions, excluding internal transfers in specific contexts like mergers.
Under the enforcement jurisdiction of the Oklahoma attorney general, the Act provides for various legal remedies, including civil penalties for unresolved infringements. It offers a non-expiring right-to-cure clause, necessitating rectification of violations within 30 days of notification. Oklahoma’s privacy legislation ultimately aims to harmonize compliance for businesses familiar with existing state regulations, streamlining data protection strategies.