Governance, risk & compliance
Oklahoma Consumer Data Privacy Act (OCDPA) Enrolled SB 546 (2026); effective 1 Jan 2027
The Oklahoma Consumer Data Privacy Act, enrolled Senate Bill 546 of 2026, effective 1 January 2027.
It is NOT in force on 24 October 2026 and its requirements are shown as recommended until then. It applies to a controller or processor that does business in Oklahoma or targets its residents and handles the data of at least 100,000 consumers, or at least 25,000 consumers while earning more than 50% of gross revenue from sale.
State bodies, GLBA financial institutions, HIPAA covered entities, nonprofits and higher education are exempt. Consumers can confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling for significant decisions, with a 60-day appeal.
Controllers must offer two or more request methods, limit collection, secure the data, obtain consent for sensitive data, use processor contracts and assess heightened-risk processing. The Attorney General alone enforces after a 30-day cure with a written statement; civil penalties reach $7,500 per violation and there is no private action.
Not verified: (1) Not in force until 1 January 2027, so every Oklahoma requirement is marked recommended until then. (2) The enrolled PDF has a blank approval block; the 20 March 2026 signing date is from a law-firm article only.
(3) The final codified citation (75A O. S.
300 to 320) is the enrolled bill’s instruction and may change; the sensitive data definition and the consent-revocation period were not itemized. (4) No universal opt-out signal requirement and no teen rule beyond COPPA known-child data was found in the text read.
General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Oklahoma Consumer Data Privacy Act (OCDPA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Controller | A person that, alone or jointly with others, determines the purpose and means of processing personal data and meets the applicability test in SB546 s.15 (100,000 consumers, or 25,000 with more than 50% of revenue from sale). Carries the notice, consumer rights, consent, security, assessment and enforcement duties. The Act is enacted but not in force until 1 January 2027, so its rows are recommended until then. | — |
| Processor | A person that processes personal data on behalf of a controller (SB546 s.9). Must follow the controller’s instructions, help with consumer requests and security, give assessment information, bind its people and subcontractors, and delete or return data at the end of the service. A processor that decides purposes and means is treated as a controller. | — |
How Lavawall® helps you get to Oklahoma Consumer Data Privacy Act (OCDPA) compliance
Most of Oklahoma Consumer Data Privacy Act (OCDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Oklahoma Consumer Data Privacy Act (OCDPA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Oklahoma Consumer Data Privacy Act (OCDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Oklahoma Consumer Data Privacy Act (OCDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Oklahoma Consumer Data Privacy Act (OCDPA) Enrolled SB 546 (2026); effective 1 Jan 2027
- Category
- Privacy
- Region
- USA - Oklahoma
- Levels
- 2 assessment tiers
All Oklahoma, United States frameworks and training →
Map this framework freeTalk to our team