There are specific considerations when determining if a breach is reportable. Notifications may only be given by specific methods.

If your breach affects residents in other jurisdictions, those individuals must be notified based on the breach notification laws of the jurisdiction where they reside.

Vendors must notify Organizations upon discovery of a breach or suspected breach. The Organization is responsible for submitting any required regulatory reporting and consumer notifications.

Violations of the Security Breach Notification Act may be enforced by the Attorney General or a district attorney in the same manner as an unlawful practice under the Oklahoma Consumer Protection Act and may obtain either actual damages for a violation a civil penalty up to $150,000 per breach or series of breaches. Organizations may be fined or penalized for Vendor violations.