Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
OCDPA
Ley de Privacidad de Datos del Consumidor de Oklahoma
Promulgada en 2026 y aún no en vigor. En gran medida al estilo de Virginia, con sus propios umbrales y periodo de subsanación.
The law in brief
The Oklahoma Consumer Data Privacy Act (OCDPA) is Oklahoma's comprehensive consumer privacy law. It takes effect on 1 January 2027. Like the other state laws built on the same model, it gives Oklahoma residents rights over their personal data and puts duties on the businesses that decide how that data is used (controllers) and on the vendors that handle it for them (processors).
Promulgada en 2026 y aún no en vigor. En gran medida al estilo de Virginia, con sus propios umbrales y periodo de subsanación.
A quién se aplica
- Empresas que tratan datos personales de residentes del estado por encima de los umbrales de la ley. Los umbrales, las exenciones y las reglas sobre datos sensibles varían según el estado.
- The thresholds usually turn on how many Oklahoma residents' personal data a business handles in a year, and whether it earns revenue from selling personal data. Check the statute for the exact figures.
- Like most state privacy laws, it exempts some organizations and data, commonly including data already covered by HIPAA or the Gramm-Leach-Bliley Act, and data about people acting in an employment or commercial capacity.
What it requires
A clear privacy notice
Publish a privacy notice describing the categories of personal data you process, why, what you share and with whom, how consumers can use their rights, and how to appeal.
Collect only what you need
Limit collection to what is adequate, relevant and reasonably necessary for the purposes you disclosed, and secure it with reasonable safeguards.
Datos sensibles
Get the consumer's opt-in consent before processing sensitive data, such as health information, biometric or genetic data, precise geolocation, and data about a known child (for whom parental consent is needed).
Contracts with processors
Bind each processor by contract to your instructions, confidentiality, deletion or return at the end of the service, and help with audits and assessments.
Honor opt-outs
Stop targeted advertising, sales and, where covered, qualifying profiling for consumers who opt out, and check whether the law requires you to honor universal opt-out signals such as Global Privacy Control.
Data protection assessments
Document an assessment before processing that presents a heightened risk, such as targeted advertising, selling personal data, processing sensitive data, and certain profiling.
Derechos de las personas
Oklahoma residents can generally ask a business to confirm and access their personal data, correct it, delete it and get a copy in a portable format, and can opt out of targeted advertising, the sale of their data, and profiling that produces legal or similarly significant effects. Businesses generally have 45 days to respond, extendable once. Residents can usually appeal a refusal.
Enforcement and penalties
La aplica el Fiscal General de Oklahoma (sin derecho de acción privada). Las infracciones conllevan sanciones civiles fijadas por la ley. Período de subsanación de 30 días.
What's changing
Not yet in effect. OCDPA takes effect on 1 January 2027. 30-day cure period. Use the time to map data and update notices; Regulatory Watch reports amendments and any rules.
What to do first
- Check the thresholds against your Oklahoma consumer numbers and any data sales.
- Map the personal and sensitive data you hold about Oklahoma residents.
- Update your privacy notice and add the opt-out routes the law requires.
- Set up requests and appeals within the response deadlines.
- Put OCDPA-ready terms in processor contracts.
- Build one program for all state laws, then add Oklahoma's departures.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
Aún no hay nada que informar. Regulatory Watch enumera las nuevas normas, medidas de cumplimiento y decisiones judiciales a medida que llegan.
Fuentes
- Actualización de mitad de año de 2026 sobre leyes estatales de privacidad Venable · Despacho de abogados o analista
- Nuevas leyes estatales de privacidad del consumidor en EE. UU.: lo que las empresas deben saber Morgan Lewis · Despacho de abogados o analista
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales