On March 16, the Oklahoma legislature passed SB 546, with Oklahoma Governor Kevin Stitt signing the bill into law on March 20. SB 546 is the twentieth state comprehensive law to be enacted and will take effect on January 1, 2027. Notably, the Oklahoma law comes after a long hiatus for state comprehensive privacy laws, with last year marking the first year since 2020 in which no new state comprehensive privacy was enacted.
SB 546 generally adheres to the standard model exemplified by most non-California state comprehensive privacy laws but is on the more “business-friendly” side of the spectrum. The law includes entity-wide exemptions for entities covered by the Gramm-Leach-Bliley Act (GLBA), as well as both covered entities and business associates regulated by the Health Insurance Portability and Accountability Act (HIPAA). It also includes exemptions for personal data processed in a “commercial” or “employment” context. Additionally, unlike many other comprehensive privacy laws,