OK SB1716

Private entities are prohibited from class action liability for security breaches unless the breach was caused by willful and wanton conduct or gross negligence.

Attorney General or district attorney has exclusive enforcement authority with civil penalties up to $150,000 per breach or series of similar breaches.

Entities using reasonable safeguards and providing required notice are exempt from civil penalties and may use compliance as an affirmative defense.

Entities failing to use reasonable safeguards but providing proper notice face a reduced civil penalty of $75,000 plus actual damages.

Effective date: November 1, 2026.