Okla. Stat. tit. 24, § 24-164
This is the official text of Okla. Stat. tit. 24, § 24-164, part of Oklahoma’s Stat. tit. 24, — part of the compiled statutory law of Oklahoma, published by the state as "Stat. tit. 24,." Browse the sections below, each linked to its official government source.
Not legal advice. This page reproduces the official text of a government statute for reference only. Laws change, and how a statute applies depends on your specific facts. For advice about your situation, consult a licensed attorney in your state.
Notice procedures deemed in compliance
Official statutory text
Oklahoma Statutes - Title 24. Debtor and Creditor Page 43
A. An individual or entity that maintains its own notification
procedures as part of an information privacy or security policy for
the treatment of personal information and that are consistent with
the timing requirements of the Security Breach Notification Act
shall be deemed to be in compliance with the notification
requirements of subsection A or B of Section 163 of this title if
the individual or entity notifies residents of this state in
accordance with its procedures in the event of a breach of security
of the system.
B. The following entities shall be deemed to be in compliance
with the notification requirements of subsection A or B of Section
163 of this title if such entities provide notice to the Attorney
General as required by subsection E of Section 163 of this title:
1. A financial institution that complies with the notification
requirements prescribed by the Gramm-Leach-Bliley Act and the
federal Interagency Guidance on Response Programs for Unauthorized
Access to Customer Information and Customer Notice;
2. An entity that complies with the notification requirements
prescribed by the Oklahoma Hospital Cybersecurity Protection Act of
2023 or the Health Insurance Portability and Accountability Act of
1996 (HIPAA); and
3. An entity that complies with the notification requirements
or procedures pursuant to the rules, regulations, procedures, or
guidelines established by the primary or functional federal
regulator of the entity.
A. An individual or entity that maintains its own notification
procedures as part of an information privacy or security policy for
the treatment of personal information and that are consistent with
the timing requirements of the Security Breach Notification Act
shall be deemed to be in compliance with the notification
requirements of subsection A or B of Section 163 of this title if
the individual or entity notifies residents of this state in
accordance with its procedures in the event of a breach of security
of the system.
B. The following entities shall be deemed to be in compliance
with the notification requirements of subsection A or B of Section
163 of this title if such entities provide notice to the Attorney
General as required by subsection E of Section 163 of this title:
1. A financial institution that complies with the notification
requirements prescribed by the Gramm-Leach-Bliley Act and the
federal Interagency Guidance on Response Programs for Unauthorized
Access to Customer Information and Customer Notice;
2. An entity that complies with the notification requirements
prescribed by the Oklahoma Hospital Cybersecurity Protection Act of
2023 or the Health Insurance Portability and Accountability Act of
1996 (HIPAA); and
3. An entity that complies with the notification requirements
or procedures pursuant to the rules, regulations, procedures, or
guidelines established by the primary or functional federal
regulator of the entity.
Status: in_force · Read it on the official government site
Need a lawyer in Oklahoma?
Find a Oklahoma lawyer
About this page: Statute text is reproduced from official government publishers via the
Open US Law dataset
(Vaquill AI, snapshot v2026.08, CC BY 4.0). Primary legislative text like this is public domain under the government-edicts doctrine
(Georgia v. Public.Resource.Org, 2020). We link every section back to its official source so you can verify it independently.