Oregon Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Under ORS 646A.604, Oregon requires businesses to notify affected consumers of a data breach as soon as practicable and no later than 45 days after discovery. The Oregon Attorney General must also be notified when a breach affects more than 250 residents. Penalties can reach $500,000 for a continuing violation.

If your business handles personal information belonging to Oregon residents, a data breach triggers specific legal obligations under the Oregon Consumer Information Protection Act. ORS 646A.600 through 646A.628 sets out who must be notified, what information triggers the duty, and how quickly you need to act. Originally enacted in 2007, strengthened through Senate Bill 601 (2015), and substantially rewritten by the 2019 amendments (2019 Or Laws ch. 180), Oregon's law stands out for its broad definition of personal information, strict 45-day notification deadline, and separate requirement to maintain reasonable security safeguards.

This guide covers the full scope of Oregon's breach notification requirements, including what personal information triggers the law, who must be notified, the timeline, enforcement penalties, exemptions, and how the law connects to the state's broader data privacy framework.

Who Must Comply With Oregon's Breach Notification Law

Oregon's breach notification law applies to a covered entity. Under ORS 646A.602(5), that means a person that owns, licenses, maintains, stores, manages, collects, processes, acquires, or otherwise possesses personal information in the course of the person's business, vocation, occupation, or volunteer activities. This covers a wide range of entities, including for-profit businesses, nonprofits, and volunteer organizations. A person is not a covered entity to the extent that it acts solely as a vendor.

Vendors carry their own separate duties. A vendor is a person a covered entity contracts with to maintain, store, manage, process, or otherwise access personal information on the covered entity's behalf. If a vendor discovers a breach or has reason to believe one occurred, it must notify the covered entity as soon as practicable but no later than 10 days after discovery, under ORS 646A.604(2)(a). The covered entity then carries the primary obligation to notify affected consumers and regulators. Under ORS 646A.604(2)(c), a vendor must notify the Attorney General directly if its breach involved the personal information of more than 250 consumers, or a number of consumers the vendor could not determine, unless the covered entity has already notified the Attorney General.

Oregon's law applies to businesses located outside the state if they hold data belonging to Oregon residents.

What Qualifies as a Breach of Security

Under ORS 646A.602, a breach of security means the unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal information that a person maintains or possesses.

The "materially compromises" threshold means not every unauthorized access triggers notification. The access must create a meaningful impact on the security or confidentiality of the data.

Inadvertent Acquisition Exception

A breach of security does not include an inadvertent acquisition of personal information by a person or the person's employee or agent, provided the personal information is not used in violation of applicable law or in a manner that harms or poses an actual threat to the security, confidentiality, or integrity of the personal information.

The 2019 amendments replaced Oregon's older "good faith acquisition" language with this narrower standard. The questions now are whether the acquisition was inadvertent and whether the information was misused or put at actual risk, not whether an employee acquired it for a business purpose.

The Encryption Safe Harbor

Oregon provides a conditional encryption safe harbor. Encrypted or redacted data does not trigger notification, unless the encryption key has also been acquired during the breach. If both the encrypted data and the key are compromised, the safe harbor does not apply and notification is required.

This is a critical distinction from states that provide an unconditional encryption safe harbor. Businesses should not assume encryption alone eliminates notification obligations.

What Personal Information Triggers the Law

Oregon has one of the broadest definitions of personal information among state breach notification laws. Under ORS 646A.602, personal information means a consumer's first name or first initial and last name in combination with any of the following data elements, when not rendered unusable through encryption, redaction, or other methods:

• Social Security number
• Driver license number or state identification card number issued by the Department of Transportation
• Passport number or other identification number issued by the United States
• Financial account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to the account
• Data from automatic measurements of a consumer's physical characteristics, such as an image of a fingerprint, retina, or iris, that are used to authenticate the consumer's identity in the course of a financial transaction or other transaction
• Health insurance policy number or health insurance subscriber identification number, in combination with any other unique identifier that a health insurer uses to identify the consumer
• Medical information, meaning any information about a consumer's medical history or mental or physical condition, or about a health care professional's medical diagnosis or treatment of the consumer

Note that the biometric element and the health insurance element both carry qualifiers that are easy to miss. Oregon covers physical measurements only where they are used to authenticate identity in a transaction, and it covers a health insurance number only when it is paired with another identifier the health insurer uses for that consumer.

Oregon also treats a username or other account identifier, together with any password or other method needed to authenticate it, as personal information on its own under ORS 646A.602(12)(a)(B). Unlike the elements above, this category does not require combination with the consumer's name.

Additionally, Oregon provides a standalone trigger: any of the above data elements, even without a name or username, qualifies as personal information if it has not been rendered unusable and would enable a person to commit identity theft.

Personal information does not include information in federal, state, or local government records (other than Social Security numbers) that is lawfully made available to the public.

Notification Timeline

Oregon imposes a firm 45-day deadline. Under ORS 646A.604, notification must be provided to affected consumers in the most expeditious manner possible, without unreasonable delay, and no later than 45 days after discovering or receiving notification of the breach.

The 45-day clock starts from the date of discovery, not the date the breach occurred. There is no general extension of that deadline for investigation purposes, although the risk-of-harm exemption described below can remove the duty to notify consumers altogether.

Law Enforcement Delay

Under ORS 646A.604(3)(c), a covered entity may delay notification only if a law enforcement agency determines that notification will impede a criminal investigation and the agency requests in writing that the covered entity delay the notification. Both conditions must be met, so an oral or informal request from an investigator does not authorize a delay, and there is no national security ground for delay in the Oregon statute. Keep the written request on file, because it is the record of why the 45-day deadline in ORS 646A.604(3)(a) was extended.

Who Must Be Notified

Affected Individuals

Unless the risk-of-harm exemption below applies, every Oregon consumer whose personal information was subject to a breach of security must receive notification. The notice must include:

• A description of the incident in general terms
• The approximate date of the breach
• The type of personal information subject to the breach
• Contact information for the covered entity
• Contact information for national consumer reporting agencies
• Advice to the consumer to report suspected identity theft to law enforcement, including the Federal Trade Commission and the Oregon Attorney General

Attorney General

The Oregon Department of Justice Consumer Protection Division must be notified when a breach affects more than 250 Oregon consumers. The AG notification must include a copy of the notice sent to consumers and the number of affected individuals.

Oregon's 250-person AG notification threshold is among the lowest in the country, ensuring the Attorney General has visibility into relatively small breaches.

Consumer Reporting Agencies

When a breach affects more than 1,000 Oregon consumers, the entity must also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis. The CRA notification must include the timing, distribution, and content of the consumer notice, along with any police report number assigned to the breach.

Credit Monitoring Offers

If a business chooses to offer free credit monitoring or identity theft prevention services in connection with a breach notice, ORS 646A.604(7) bars conditioning that offer on the consumer providing a credit or debit card number or accepting a separate paid service. Any additional service offered for a fee must be clearly and conspicuously disclosed as carrying a charge. Oregon law does not require businesses to offer credit monitoring after a breach; it only regulates the terms of an offer a business chooses to make.

Methods of Notification

Businesses can provide notification through:

• Written notice sent to the consumer's postal address in the most current records of the person
• Electronic notice, if the covered entity customarily communicates with the consumer electronically or the notice is consistent with the federal E-SIGN Act
• Telephone notice directly to the affected consumer

Substitute Notice

Substitute notice is available if the person demonstrates that:

• The cost of providing direct notice would exceed $250,000, or
• The affected class exceeds 350,000 consumers, or
• The person does not have sufficient contact information

Note that Oregon's substitute notice threshold for affected class size (350,000) is lower than the 500,000 threshold used in many states.

Substitute notice must include: conspicuous posting of the notice or a link to it on the covered entity's website, and notification to major statewide television and newspaper media.

Enforcement and Penalties

Attorney General Enforcement

A violation of ORS 646A.604 (breach notification) or ORS 646A.622 (reasonable safeguards) is an unlawful trade practice under ORS 646.607, which the Oregon Attorney General enforces through the state's Unlawful Trade Practices Act.

DCBS Director Enforcement and Civil Penalties

Separately, ORS 646A.624 gives the Director of the Department of Consumer and Business Services (DCBS) independent authority to investigate violations, subpoena witnesses, and issue cease-and-desist orders. Under this authority, the penalty structure is:

• Up to $1,000 per violation
• Up to $500,000 for a continuing violation

These civil penalties are imposed by the DCBS Director, not the Attorney General. The $500,000 cap for continuing violations makes Oregon's penalty structure among the more significant in the country, particularly for businesses that knowingly delay notification or fail to maintain required safeguards.

No Express Private Right of Action

Oregon's breach notification statute does not create an express private right of action. However, because violations are classified as unlawful trade practices, consumers may have remedies under Oregon's general Unlawful Trade Practices Act, which does provide for private enforcement in certain circumstances.

Reasonable Safeguards Requirement

Unlike many states that focus solely on breach notification, Oregon imposes a separate obligation to maintain reasonable safeguards. Under ORS 646A.622, a covered entity and a vendor must develop, implement, and maintain reasonable safeguards to protect the security, confidentiality, and integrity of personal information, including safeguards that protect the information at disposal.

This means Oregon businesses face compliance obligations before any breach occurs. Failure to maintain reasonable safeguards is itself a violation, regardless of whether a breach has happened.

The statute also sets out ways to comply, including running an information security program with administrative, technical, and physical safeguards scaled to the volume and nature of the personal information held. That gives businesses flexibility but also sets a minimum standard that scales with the sensitivity and amount of data.

Exemptions

Risk-of-Harm Exemption

Under ORS 646A.604(8), a covered entity does not need to notify consumers of a breach of security if, after an appropriate investigation or after consultation with relevant federal, state, or local law enforcement agencies, it reasonably determines that the consumers whose personal information was subject to the breach are unlikely to suffer harm. The covered entity must document that determination in writing and maintain the documentation for at least five years.

This is a determination the business makes itself rather than one a regulator approves in advance, so the written record is what supports the decision if it is questioned later.

HIPAA Compliance Exemption

Entities subject to and in compliance with HIPAA's breach notification requirements are deemed in compliance with Oregon's law.

Financial Institution Exemption

Financial institutions subject to and in compliance with the Gramm-Leach-Bliley Act's breach notification guidelines are also exempt.

Compliance With Other Notification Rules

An entity that already provides breach notice under rules that another law, regulation, or its primary functional regulator imposes, with protections at least as rigorous as Oregon's, is deemed in compliance with the state's notification requirements under ORS 646A.604(9). Oregon law does not offer a safe harbor merely for following an internal notification policy.

The Attorney General Copy Is Still Required

The exemptions in ORS 646A.604(9) do not switch off the Attorney General. Under ORS 646A.604(10), a person, covered entity, or vendor must still provide the Attorney General, within a reasonable time, at least one copy of any notice it sends to consumers or to its primary or functional regulator as a consequence of a breach, whenever the breach affects more than 250 consumers.

This article provides general legal information about Oregon data privacy laws and breach notification requirements. It is not legal advice, and it does not create an attorney-client relationship. Data breach response involves time-sensitive obligations. Consult a qualified attorney licensed in Oregon for guidance specific to your situation.

More Oregon Laws

• Oregon Deepfake Laws
• Oregon Employee Monitoring Laws
• Oregon GPS Tracking Laws
• Oregon Recording Laws