Obligations United States Oklahoma
What a Oklahoma business has to have in writing
Oklahoma's written-policy load is light on employment mandates but has grown quickly on the data side: the 2025 breach-law rewrite adds Attorney General reporting and defines reasonable safeguards, a comprehensive consumer privacy act takes effect in 2027, and insurers have carried a written security program duty since 2024.
The one long-standing employer policy mandate is the drug and alcohol testing statute, which requires a written policy before any testing. Federal OSHA covers private workplaces; there is no state plan.
Oklahoma's equal pay statute carries no posting or record duty, and there is no standalone biometric law: biometric data will be treated as sensitive data under the 2027 privacy act.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
OklahomaHandbook 2026acknowledged by name
Oklahoma on Recordwith AllyMatter
Cover Oklahoma the Modern WayEvery policy Oklahoma makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Oklahoma on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Oklahoma rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Security Breach Notification Act (as amended by SB 626, 2025)AI-compiled24 O.S. 161-166Any individual or entity that owns, licenses or maintains computerized personal information about Oklahoma residentsDistribute
Notice
Written, phone or electronic notice to affected residents without unreasonable delay after a breach is determined, and a report to the Attorney General within 60 days of the resident notice when 500 or more residents are affected (1,000 for credit bureaus), describing the breach, data types, headcount, estimated cost and the safeguards in place.
From the first employee
Oklahoma Attorney General; district attorneys
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Oklahoma Hospital Cybersecurity Protection Act of 2023 (HB 2790)AI-compiled63 O.S., HB 2790 (2023)Licensed hospitals seeking the statutory affirmative defense against data-breach tort claimsWrite
Written program
A written cybersecurity program that follows a recognized framework (for example HIPAA/HITECH or NIST) and is kept current; hospitals that maintain one gain an affirmative defense rather than facing a direct penalty.
From the first employee
Civil courts (affirmative defense); Oklahoma State Department of Health licenses hospitals
AuthorityOklahoma Legislature
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Oklahoma Consumer Data Privacy Act (SB 546, 2026)AI-compiled75A O.S. 300 et seq. (effective Jan. 1, 2027)Controllers and processors doing business in Oklahoma that handle personal data of 100,000+ consumers a year, or 25,000+ consumers with more than half of revenue from selling personal data; nonprofits, state agencies, higher education and HIPAA/GLBA-regulated data are exemptWrite
Written policy
A public privacy notice covering data categories, purposes, sharing and how consumers exercise rights; written processor contracts; documented data protection assessments for higher-risk processing; and a process to answer consumer requests within 45 days.
From the first employee
Oklahoma Attorney General (exclusive), with a cure period before suit
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
Oklahoma Insurance Data Security Act (SB 543, 2024)AI-compiled36 O.S. 670-679Insurers, producers and other Oklahoma Insurance Department licensees; licensees under $5 million in gross annual revenue and certain captives and risk retention groups are exemptWrite
Written program
A written information security program built on a documented risk assessment with a named responsible person, an incident response plan, board oversight, and an annual data security attestation filed with the Insurance Department by April 15; cybersecurity events are reported to the Commissioner within three business days.
From the first employee
Oklahoma Insurance Department
State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state
LawProduceWhat it requiresTriggerEnforced by
OMES Oklahoma Cyber Command third-party security program (Authority to Operate Order)AI-compiledOMES information security standards; 62 O.S. 34.11 et seq. (OMES Information Services)Vendors and cloud providers that access, process, store or transmit Oklahoma state agency dataCertify + ack
Certification
A completed NIST-based security assessment (or an accepted certification such as StateRAMP/GovRAMP, FedRAMP, SIG or CSA CAIQ) leading to an Authority to Operate Order signed by the state CISO before handling state data.
From the first employee
Office of Management and Enterprise Services, Oklahoma Cyber Command
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Oklahoma required workplace postersAI-compiled40 O.S. 197.1 et seq. (minimum wage); 40 O.S. 71 et seq. (child labor); 85A O.S. (workers' compensation); 25 O.S. 1101 et seq. (anti-discrimination)Every Oklahoma employer with at least one employeePost
Posting
Post the state minimum wage, child labor, workers' compensation, unemployment insurance and anti-discrimination notices where employees can see them, alongside the federal posters.
From the first employee
Oklahoma Department of Labor; Oklahoma Employment Security Commission; Workers' Compensation Commission
Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity registration with the Oklahoma Secretary of StateAI-compiled18 O.S. (Oklahoma General Corporation Act; Limited Liability Company Act)Corporations, LLCs, limited partnerships and foreign entities doing business in Oklahoma; trade names for sole proprietors and partnershipsFile
Filing / record
File formation or foreign-registration documents online with the Secretary of State and keep up annual certificates or franchise-tax filings depending on entity type.
From the first employee
Oklahoma Secretary of State
Oklahoma Tax Commission business registration (sales tax permit, withholding account)AI-compiled68 O.S. 1364 (sales tax permits); 68 O.S. 2385.1 et seq. (withholding)Any business selling taxable goods or services or paying wages in OklahomaFile
Filing / record
Register through OkTAP for a sales tax permit and a withholding tax account before making taxable sales or paying employees, then file the periodic returns.
From the first employee
Oklahoma Tax Commission
Construction trade licensing and roofing registration (Construction Industries Board)AI-compiled59 O.S. 1680.1 et seq. (electrical); 59 O.S. 1001 et seq. (plumbing); 59 O.S. 1850.1 et seq. (mechanical); 59 O.S. 1151.1 et seq. (roofing)Electrical, plumbing and mechanical contractors and journeymen, and roofing contractors; general contractors have no state license requirementCertify
Certification
Hold a current Construction Industries Board contractor or journeyman license for the trade performed, or a roofing contractor registration, and renew it on the board's schedule.
From the first employee
Oklahoma Construction Industries Board
Other Written Policies 2Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Standards for Workplace Drug and Alcohol Testing Act (as amended by HB 3127, 2026)AI-compiled40 O.S. 551-565; 63 O.S. 427.8 (medical marijuana employment provisions)Any Oklahoma employer that requests or requires applicant or employee drug or alcohol testingWrite
Written policy
A written testing policy adopted before any testing that names who is tested, when, for what substances, the procedures and the consequences, given to employees with at least 10 days' notice of a new or changed policy; safety-sensitive positions relied on for marijuana-related decisions must be identified under that policy from Nov. 1, 2026.
From the first employee
Civil action by employees and applicants; Oklahoma State Department of Health licenses testing facilities
Child labor work permits (Employment Certificate of Age and Schooling)AI-compiled40 O.S. 71-89Any employer hiring minors aged 14 or 15File
Filing / record
Obtain and keep on file a completed Form 601 employment certificate issued by the minor's school before the minor starts work, and follow the hour limits for school and non-school days.
From the first employee
Oklahoma Department of Labor, Child Labor Unit
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Oklahoma on top
Small businessFederal + industry, with Oklahoma on topConstruction contractorsFederal + industry, with Oklahoma on topHealthcare practicesFederal + industry, with Oklahoma on topFood and beverage businessesFederal + industry, with Oklahoma on topTax and accounting firmsFederal + industry, with Oklahoma on topRegistered investment advisersFederal + industry, with Oklahoma on topInsurance agenciesFederal + industry, with Oklahoma on topRetail and e-commerceFederal + industry, with Oklahoma on topTrucking and logistics carriersFederal + industry, with Oklahoma on topNonprofitsFederal + industry, with Oklahoma on topFederal contractorsFederal + industry, with Oklahoma on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Oklahoma Attorney General - Data Security Breach Reporting FormOklahoma Legislature - Enrolled SB 626 (2025)Oklahoma LegislatureOklahoma House of Representatives - SB 546 signing releaseOklahoma Legislature - Enrolled SB 546 (2026)Oklahoma Insurance Department - Insurance Data Security ActOklahoma Insurance Department - Bulletin 2024-10OMES Oklahoma Cyber Command - Third-Party SecurityOMES - Cloud Computing StandardOklahoma Department of Labor - Workplace PostersOklahoma Employment Security CommissionOklahoma Secretary of State - Business FilingOklahoma.gov - Register Your BusinessOklahoma Tax Commission - New Business CenterOklahoma Tax Commission - OkTAPOklahoma Construction Industries BoardOklahoma.gov - Construction Industries Board agency pageOklahoma State Department of Health - Facility Services Division (workplace drug and alcohol testing facilities)Oklahoma Department of Labor - Work PermitOklahoma Department of Labor - Child Labor Unit