{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Crowe Dunlevy","Anthony Hendricks"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Oklahoma"]
["Key Legislation Overview"]
["1. What is the key legislation?"," Oklahoma has no single comprehensive data privacy legislation. Instead, Oklahoma has enacted several laws that safeguard personal information and an individual's right to privacy. Relevant state laws related to data privacy in Oklahoma include:  \n\n \n\t Financial Privacy Act (6 O.S. §§ 2201 – 2208 ) \n\t Security Breach Notification Act (24 O.S. §§ 161 – 166) \n\t Electric Usage Data Protection Act (17 O.S. § 710.4)  \n\t Personal Privacy Protection Act (51 O.S. § 50) \n\t Statutes regarding unsolicited commercial communications including the Fraudulent Use of Electronic Mail Act (15 O.S. (§§ 776.1 - 776.7), Anti-Phishing Act (15 O.S. § 776.8 - 776.12), Anti-Caller Id Spoofing Act (15 O.S. § 776.23), Oklahoma Consumer Protection Act provisions on commercial telephone solicitation (15 O.S. § 775A.4). \n\t Security of Communication Act (13 O.S. §§ 176.1 - 176.7) \n\t Student Data Accessibility, Transparency and Accountability Act of 2013 (70 of O.S. § 3-168) \n \n\n Along with state law, companies and individuals in Oklahoma may also have to comply with Federal laws related to data privacy and security.  \n"]
["2. What are the key decisions applying that legislation?"]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?"]
["2. How is the defined data protected?"]
["3. Who is subject to privacy obligations?","Applicability varies by law. Below is a discussion of the subject of the state privacy laws:\nFinancial Privacy Act Oklahoma’s \nFinancial Privacy Act applies to financial institutions. \nSecurity Breach Notification ActOklahoma’s \nSecurity Breach Notification Act applies to individuals and entities that owns or licenses computerized data that includes personal information of any resident of Oklahoma. \nStudent Data Accessibility, Transparency and Accountability Act of 2013 The \nStudent Data Accessibility, Transparency and Accountability Act only addresses the Oklahoma Department of Education and does not address the records held by individual schools.\n"]
["4. How is “data processing” defined?"]
["5. What are the principles applicable to personal data processing?","There is not an Oklahoma specific statute regarding this. \n"]
["6. How is the processing of personal data regulated?","Oklahoma does not have a specific law that addresses this. \n"]
["7. How are storage, security and retention of personal data regulated?","Oklahoma does not have a specific law that addresses this. \n"]
["8. What are the data subjects' rights under the data legislation?","There are no Oklahoma laws. \n"]
["9. What are the consent requirements for data subjects?"]
["10. How is authorization for use of data handled?"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?","There are no Oklahoma laws. \n"]
["12. How are data \"incidents\" and \"breaches\" defined?"]
["13. Are there any notification requirements for incidents and/or data breaches?"," Entities and individuals are required to notify any affected individual if:  \n\n \n\t unredacted or unencrypted personal information was accessed and acquired by an unauthorized person. \n\t the encrypted information is accessed and acquired in an unencrypted form or; \n\t the security breach involves a person with access to the encrypted key \n \n\n Notice under the Security Breach Notification Act can be delayed if a law enforcement agency advises that disclosure would impede an investigation or impact national or homeland security.   \n"]
["14. Who is/are the privacy regulator(s)?","The Oklahoma Attorney General regulates privacy. \n"]
["15. What are the consequences of a data breach?","Following a data breach, the entities and individuals are required to provide notices to the affected parties. Please see the section on notification requirements. \n"]
["16. How is electronic marketing regulated?","Electronic marketing is subject to the \nOklahoma Consumer Protection Act along with laws that address spoofing and phishing. \nOklahoma Consumer Protection ActThe \nOklahoma Consumer Protection Act prohibits several enumerated “unfair or deceptive trade practices,” including misrepresentations, false statements, and bait and switch advertising.  \nAnti-Caller ID Spoofing Act The \nAnti-Caller ID Spoofing Act makes it illegal for a caller to knowingly insert false information into a caller identification system with the intent to mislead, defraud, or deceive the recipient of a telephone call (\n15 O.S. § 776.23).\nAnti-Phishing Act Oklahoma has an \nAnti-Phishing Act that makes it unlawful for any person, by means of a web page or link to a webpage to solicit, request, or take any action to induce another person to provide identifying information by representing himself, herself, or itself to be a business without the authority or approval of the business (\n15 O.S. § 776.8 - 776.12). The \nAnti-Phishing Act provides a private right of action that allows victims to seek injunctive relief and damages.\nFraudulent Use of Electronic MailThe \nFraudulent Use of Electronic Mail provision of the \nOklahoma Consumer Protection Act makes it unlawful to send an e-mail when the sender knows that the e-mail does not contain an identifying point of origin or contains false, misleading, or malicious material that could purposefully or negligently injure a person (\n§§ 776.1 - 776.7 of Title 15 of the O.S.).  \n"]
["17.\tAre there sector-specific or industry-specific privacy requirements?"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?"]
["19.\tWhat are the record-keeping and documentation obligations?"]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?"]
["21.\tWhat are the requirements for third-party vendor management and data sharing?"]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?"]
["23.\tWhat are the ongoing compliance and audit requirements?"]
["24. Are there any recent developments or expected reforms?","The Oklahoma State Legislature is currently debating two consumer data privacy laws.\nThe \n2021 Oklahoma Computer Data Privacy act would require businesses to get consent before collecting data, and consumers would have to opt-in to the sale of their data. The bill also provides consumer rights.   \nThe 2022 version of the bill only allows businesses to collect and share data with third parties only if it is necessary to provide goods and services. Companies would also be required to inform consumers of their right to opt out of personalized advertising. The bill also includes consumer rights.  \n"]