A 1 An individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) that owns or licenses computerized data that includes personal informationPersonal information"Personal information" means an individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements, if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through the breach of security: a. social security number, b. driver license number or other unique identification number created or collected by a government entity, c. financial account number, or credit card or debit card number, in combination with any required expiration date, security code, access code, or password that would permit access to an individual's financial account, d. unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual's financial account, or e. unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual. The term does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.24 O.S. § 162(6) shall provide notice of any breach of the security of the system following determination or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal informationPersonal information"Personal information" means an individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements, if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through the breach of security: a. social security number, b. driver license number or other unique identification number created or collected by a government entity, c. financial account number, or credit card or debit card number, in combination with any required expiration date, security code, access code, or password that would permit access to an individual's financial account, d. unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual's financial account, or e. unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual. The term does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.24 O.S. § 162(6) was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) reasonably believes has caused or will cause, identity theft or other fraud to any resident of this state. Except as provided in subsection D of this section or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the disclosure shall be made without unreasonable delay.

B 2 An individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) shall provide notice of the breach of the security of the system if encryptedEncrypted"Encrypted" means transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without use of a confidential process or key, or securing the information by another method that renders the data elements unreadable or unusable.24 O.S. § 162(3) or redacted information is accessed and acquired in an unencrypted or unredacted form or if the security breach involves a person with access to the encryption key and the individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) reasonably believes that such breach has caused or will cause identity theft or other fraud to any resident of this state.

C 3 An individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) that maintains computerized data that includes personal informationPersonal information"Personal information" means an individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements, if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through the breach of security: a. social security number, b. driver license number or other unique identification number created or collected by a government entity, c. financial account number, or credit card or debit card number, in combination with any required expiration date, security code, access code, or password that would permit access to an individual's financial account, d. unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual's financial account, or e. unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual. The term does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.24 O.S. § 162(6) that the individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) does not own or license shall provide noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) to the owner or licensee of the information of any breach of the security of the system as soon as practicable following determination, if the personal informationPersonal information"Personal information" means an individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements, if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through the breach of security: a. social security number, b. driver license number or other unique identification number created or collected by a government entity, c. financial account number, or credit card or debit card number, in combination with any required expiration date, security code, access code, or password that would permit access to an individual's financial account, d. unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual's financial account, or e. unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual. The term does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.24 O.S. § 162(6) was or if the entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) reasonably believes it was accessed and acquired by an unauthorized person.

D NoticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) required by this section may be delayed if a law enforcement agency determines and advises the individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) that the noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) will impede a criminal or civil investigation or homeland or national security. NoticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) required by this section must be made without unreasonable delay after the law enforcement agency determines that notification will no longer impede the investigation or jeopardize national or homeland security.

E(1)–(3) 4 1. An individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) required to provide noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) in accordance with subsection A or B of this section shall also provide noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) to the Attorney General of such breach without unreasonable delay but in no event more than sixty (60) days after providing noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) to impacted residents of this state as required by this section. The noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) shall include the date of the breach, the date of its determination, the nature of the breach, the type of personal informationPersonal information"Personal information" means an individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements, if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through the breach of security: a. social security number, b. driver license number or other unique identification number created or collected by a government entity, c. financial account number, or credit card or debit card number, in combination with any required expiration date, security code, access code, or password that would permit access to an individual's financial account, d. unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual's financial account, or e. unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual. The term does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.24 O.S. § 162(6) exposed, the number of residents of this state affected, the estimated monetary impact of the breach to the extent such impact can be determined, and any reasonable safeguardsReasonable safeguards"Reasonable safeguards" means policies and practices that ensure personal information is secure, taking into consideration an entity's size and the type and amount of personal information. The term includes, but is not limited to, conducting risk assessments, implementing technical and physical layered defenses, employee training on handling personal information, and establishing an incident response plan.24 O.S. § 162(8) the entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) employs. 2. A breach of a security system where fewer than five hundred (500) residents of this state are affected within a single breach shall be exempt from the noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) requirements of paragraph 1 of this subsection. 3. A breach of a security system maintained by a credit bureau where fewer than one thousand (1,000) residents of this state are affected within a single breach shall be exempt from the noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) requirements of paragraph 1 of this subsection.

F Any personal informationPersonal information"Personal information" means an individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements, if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through the breach of security: a. social security number, b. driver license number or other unique identification number created or collected by a government entity, c. financial account number, or credit card or debit card number, in combination with any required expiration date, security code, access code, or password that would permit access to an individual's financial account, d. unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual's financial account, or e. unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual. The term does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.24 O.S. § 162(6) submitted to the Attorney General shall be kept confidential pursuant to Section 24A.12 of Title 51 of the Oklahoma Statutes.

A An individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal informationPersonal information"Personal information" means an individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements, if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through the breach of security: a. social security number, b. driver license number or other unique identification number created or collected by a government entity, c. financial account number, or credit card or debit card number, in combination with any required expiration date, security code, access code, or password that would permit access to an individual's financial account, d. unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual's financial account, or e. unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual. The term does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.24 O.S. § 162(6) and that are consistent with the timing requirements of the Security Breach Notification Act shall be deemed to be in compliance with the notification requirements of subsection A or B of Section 163 of this title if the individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) notifies residents of this state in accordance with its procedures in the event of a breach of security of the system.

B(1)–(3) The following entities shall be deemed to be in compliance with the notification requirements of subsection A or B of Section 163 of this title if such entities provide noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) to the Attorney General as required by subsection E of Section 163 of this title: 1. A financial institutionFinancial institution"Financial institution" means any institution the business of which is engaging in financial activities as defined by 15 U.S.C., Section 6809.24 O.S. § 162(4) that complies with the notification requirements prescribed by the Federal Gramm-Leach-Bliley Act and the federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer NoticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7); 2. An entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) that complies with the notification requirements prescribed by the Oklahoma Hospital Cybersecurity Protection Act of 2023 or the Health Insurance Portability and Accountability Act of 1996 (HIPAA); and 3. An entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, or guidelines established by the primary or functional federal regulator of the entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2).

A A violation of the Security Breach Notification Act that results in injury or loss to residents of this state may be enforced by the Attorney General or a district attorney in the same manner as an unlawful practice under the Oklahoma Consumer Protection Act.

B Except as provided in subsection D of this section, the Attorney General or a district attorney shall have exclusive authority to bring an action and may obtain actual damages for a violation of the Security Breach Notification Act and a civil penalty not to exceed One Hundred Fifty Thousand Dollars ($150,000.00) per breach of the security of the system or series of breaches of a similar nature that are determined in a single investigation. Civil penalties shall be based upon the magnitude of the breach, the extent to which the behavior of the individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) contributed to the breach, and any failure to provide the noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) required by Section 163 of this title.

C(1)–(2) 1. An individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) that uses reasonable safeguardsReasonable safeguards"Reasonable safeguards" means policies and practices that ensure personal information is secure, taking into consideration an entity's size and the type and amount of personal information. The term includes, but is not limited to, conducting risk assessments, implementing technical and physical layered defenses, employee training on handling personal information, and establishing an incident response plan.24 O.S. § 162(8) and provides noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) as required by Section 163 or 164 of this title shall not be subject to civil penalties and may use such compliance as an affirmative defense in a civil action filed under the Security Breach Notification Act. 2. An individualIndividual"Individual" means a natural person.24 O.S. § 162(5) or entityEntity"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.24 O.S. § 162(2) that fails to use reasonable safeguardsReasonable safeguards"Reasonable safeguards" means policies and practices that ensure personal information is secure, taking into consideration an entity's size and the type and amount of personal information. The term includes, but is not limited to, conducting risk assessments, implementing technical and physical layered defenses, employee training on handling personal information, and establishing an incident response plan.24 O.S. § 162(8) but provides noticeNotice"Notice" means: a. written notice to the postal address in the records of the individual or entity, b. telephone notice, c. electronic notice, or d. substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed Fifty Thousand Dollars ($50,000.00), or that the affected class of residents to be notified exceeds one hundred thousand (100,000) persons, or that the individual or the entity does not have sufficient contact information or consent to provide notice as described in subparagraph a, b, or c of this paragraph. Substitute notice consists of any two of the following: (1) email notice if the individual or the entity has email addresses for the members of the affected class of residents, (2) conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a public website, or (3) notice to major statewide media.24 O.S. § 162(7) as required by Section 163 or 164 of this title shall not be subject to the civil penalty set forth in subsection B of this section but shall be subject to actual damages and a civil penalty of Seventy-five Thousand Dollars ($75,000.00).

D A violation of the Security Breach Notification Act by a state-chartered or state-licensed financial institutionFinancial institution"Financial institution" means any institution the business of which is engaging in financial activities as defined by 15 U.S.C., Section 6809.24 O.S. § 162(4) shall be enforceable exclusively by the primary state regulator of the financial institutionFinancial institution"Financial institution" means any institution the business of which is engaging in financial activities as defined by 15 U.S.C., Section 6809.24 O.S. § 162(4).

The Security Breach Notification Act shall apply to the determination or notification of a breach of the security of the system that occurs on or after January 1, 2026.