Oklahoma's New Privacy Law: What Your Business Needs to Do Before January 2027
Seven years is a long time to wait. But after nearly a decade of stalled bills, failed Senate votes, and legislative compromise, Oklahoma is finally on the verge of joining the growing number of U.S. states with a comprehensive consumer data privacy law. On February 19, 2026, the Oklahoma House of Representatives passed Senate Bill 546 by an overwhelming 84–4 vote and with Governor Kevin Stitt's signature on March 20, 2026, Oklahoma residents are about to have new legal rights over their personal data. [1] The bill is set to take effect on January 1, 2027. Here's what you actually need to know.
The Basics: What is SB 546?
The legislation makes Oklahoma the 21st state to enact a comprehensive consumer privacy law, joining a growing patchwork of state-level protections that now covers roughly half the country. The bill offers more of a middle-ground framework that grants consumers meaningful rights without going as far as California's more aggressive approach.
The most important thing for businesses: enforcement is vested exclusively in the Oklahoma Attorney General, and there is no private right of action. That means consumers cannot sue you directly. This does not mean that the obligation to build compliant programs is optional, as AG enforcement and reputational risk are very real.
Who Does This Law Actually Cover?
Not every business operating in Oklahoma will be subject to SB 546. The bill covers any business that controls or processes the personal data of at least 100,000 consumers, or the data of at least 25,000 consumers and derives more than 50% of its gross revenue from the sale of personal data. In practice, this means the law targets larger data-driven companies, not small local businesses.
Several categories are exempt entirely. Standard entity-level exemptions apply, shielding HIPAA-covered entities, GLBA financial institutions, non-profits, and governmental bodies from the law's reach.
Steps Businesses Must Take Before January 1, 2027
Start with the fundamentals: determine whether your business meets SB 546's coverage thresholds, then map the data you hold on Oklahoma consumers, where it lives, how it flows, and who has access to it. From there, you'll need to update your privacy notices to reflect the law's disclosure requirements, build or audit your data subject request workflows so you can respond to access, correction, deletion, and portability requests within required timeframes, and conduct formal data protection assessments for any high-risk processing activities.
Getting this right isn't just about avoiding a monetary penalty. It's about building a privacy infrastructure that scales as the regulatory landscape keeps expanding. Oklahoma's passage underscores the growing complexity companies face navigating a patchwork of state requirements, and that patchwork isn't getting smaller. Businesses that invest in scalable, multi-state privacy compliance now will be far better positioned as more states follow suit.
Oklahoma's seven-year road to a privacy law is over. For businesses, the work is just beginning. With a January 1, 2027 effective date and no private right of action to worry about, there's time to get this right, but not time to wait. Whether you're building a privacy program from the ground up or extending an existing one to cover Oklahoma's requirements, the steps are clear and the deadline is firm.