Legal statutes for cybersecurity and information security exist both at the state level for Oklahoma as well as at the federal level. If your organization is multi-national, you may have requirements that exist outside of the United States as well.
At a high-level, three main acts exist within the state of Oklahoma. These include:
Security Breach Notification Act
Scope: all organizations within the state, this includes not-for-profits as well as for-profit businesses. The organization must own or license computerized data including personal information.
Read more on what is considered personal information in the act by reading SB 626 (link). In the coming weeks, we will be meeting with the author of this bill to provide greater clarity.
To learn more about how you can fulfill your security obligations under this bill visit our Safeguards page.
Insurance Data Security Act
Scope: insurers and covered licensees. The following insurance entities are exempt from this act, based on sections 672(9) (link) and 678 (link):
- Foreign Purchasing Groups;
- Foreign Risk Retention Groups;
- Foreign and alien Assuming Insurers;
- Licensees authorized to operate or registered pursuant to Title 59 (Pharmacy Benefit Managers and Bail Bondsmen), and Title 15 (Service Warranty Associations)
- Vehicle Protection Product Warrantors [Title 36 O.S. § 6652(B)]
- Captive Insurance Companies [Title 36 O.S. § 6470.10(E)(2)
- Licensees with less than $5 million ($5,000,000.00) in gross annual revenue (not limited to Oklahoma revenue); and
- An employee, agent, representative, or designee of a licensee who is also a licensee, is exempt from this act and shall not be required to develop their own information security program to the extent that the employee, agent, representative, or designee is covered by the information security program of the licensee.
You may read this bill in full on Westlaw under the Official Oklahoma Statutes (link).
To learn more about how you can fulfill your security obligations under this bill visit our Safeguards page.
Business Corporation Act
NOTE: None of this information is a substitute for legal advice. Please consult your attorney for all legal advice.