Data Breach Notice to Residents and State Authorities in Oregon
At a glance
| Covered entity and service provider | A covered entity owns, licenses or otherwise possesses personal information in business, occupational or volunteer activity; a sole vendor is separately defined. A vendor must tell its contracting covered entity, or upstream vendor, as soon as practicable and within 10 days after discovery or reason to believe a breach occurred (§§ 646A.602(5), (19), .604(2)(a)-(b)). |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized data materially compromising personal information; inadvertent harmless acquisition by the person or its employee or agent is excluded. Covered data include identity-plus-identifier, financial-access, biometric, health and account-credential combinations, with encryption-key and public-record qualifications (§ 646A.602(1), (12)). |
| Risk screen or notice exception | After appropriate investigation or law-enforcement consultation, a covered entity may omit consumer notice if it reasonably determines harm is unlikely, documents that decision in writing and keeps it at least five years (§ 646A.604(8)). |
| Individuals who receive notice | The covered entity notifies the Oregon resident whose personal information is involved; the statutory consumer definition is an individual resident of Oregon (§§ 646A.602(2), .604(1)(a)). |
| Individual notice deadline and clock | Most expeditious manner possible, without unreasonable delay, and no later than 45 days after the covered entity discovers or receives notification of the breach; only the written law-enforcement request in § 646A.604(3)(c) authorizes the listed delay. |
| Regulator threshold and deadline | The covered entity gives written or electronic Attorney General notice when it must notify more than 250 consumers; its § 646A.604(3)(a) breach-notice clock is 45 days after discovery or receipt. A vendor must notify the Attorney General if its breach involves more than 250 consumers or an indeterminate count, unless the covered entity has done so (§ 646A.604(1)(b), (2)(c), (3)). |
| Consumer-reporting-agency notice | For a breach affecting more than 1,000 consumers, the covered entity notifies all nationwide consumer-reporting agencies without unreasonable delay of the consumer notice’s timing, distribution and content and any assigned police-report number; this cannot delay consumer notice (§ 646A.604(6)). |
| Individual delivery and content | Written, qualifying electronic, direct telephone, or permitted substitute notice. Notice must describe the breach generally, approximate date, data type, covered-entity contact, national reporting-agency contact, and advice to report suspected identity theft to law enforcement and named agencies (§ 646A.604(4)-(5)). |
| Substitute notice conditions and channels | Substitute notice is allowed if ordinary notice would cost over $250,000, more than 350,000 consumers are affected, or contact information is insufficient. It requires conspicuous website posting or a link if the entity has a site, and notice to major statewide television and newspaper media (§ 646A.604(4)(d)). |
| Delays and alternate compliance | A law-enforcement agency must find notice would impede a criminal investigation and request delay in writing. Specified federal-regulator, stronger-law, GLBA and HIPAA/HITECH routes may substitute; even with those exemptions, more than 250 affected consumers requires an Attorney General copy of a notice sent to consumers or the primary regulator within a reasonable time (§ 646A.604(3)(c), (9)-(10)). |
Requirements one by one
Which data and entities count
Section 646A.602(1) defines a breach as unauthorized acquisition of computerized data that materially compromises personal information. Its personal-information definition includes combinations of names and identifiers, financial access information, biometrics, health information, account credentials, and certain stand-alone elements that enable identity theft. The encryption-key and public-record qualifications matter. A covered entity has the direct notice duty; a vendor has an upstream notice duty under § 646A.604(2).
Resident, vendor and regulator clocks
Under § 646A.604(1) and (3), the covered entity notifies the affected Oregon resident as expeditiously as possible, without unreasonable delay, and within 45 days after discovering or receiving notice of the breach. It also gives written or electronic notice to the Attorney General if more than 250 residents must receive notice. A vendor must notify its covered entity or upstream vendor as soon as practicable and no later than 10 days after discovering or having reason to believe a breach occurred. A vendor also has a separate Attorney General duty for more than 250 affected residents or an indeterminate count, unless the covered entity has already notified the Attorney General.
Method, content and substitute notice
Section 646A.604(4) permits written notice, qualifying electronic notice, direct telephone contact or substitute notice. The notice must include the general breach description, approximate date, data type, covered-entity contact, national reporting-agency contact, and advice about reporting suspected identity theft under subsection (5). Substitute notice is available if ordinary notice costs over $250,000, affects more than 350,000 consumers, or sufficient contact information is missing. It requires website posting or a link if the entity has a site and notice to major statewide television and newspaper media. For more than 1,000 affected consumers, subsection (6) adds notice to nationwide consumer-reporting agencies without unreasonable delay; that step cannot hold up the individual notice.
Risk review, delay and alternate compliance
Section 646A.604(8) permits a covered entity to omit consumer notice after an appropriate investigation or law-enforcement consultation reasonably finds harm unlikely, if it writes down the determination and retains it for at least five years. Subsection (3)(c) allows a delay only on a law-enforcement agency’s written request after it determines notice would impede a criminal investigation. Subsections (9)-(10) address specified federal and stronger-law compliance routes, but require an Attorney General copy of a qualifying consumer or primary-regulator notice for a breach affecting more than 250 consumers within a reasonable time.
What trips people up
The 45-day clock begins when the covered entity discovers or receives notification of the breach; the vendor’s 10-day clock can begin when it has reason to believe one occurred. The covered-entity Attorney General trigger is more than 250 consumers who must receive notice, while a vendor’s separate trigger includes an indeterminate count. The harm exception needs a written decision retained for five years.
Statutes and sources
- Or. Rev. Stat. § 646A.602(1), § 646A.602(2), § 646A.602(5), § 646A.602(12), § 646A.602(19), § 646A.604(1), § 646A.604(2), § 646A.604(3), § 646A.604(4), § 646A.604(5), § 646A.604(6), § 646A.604(8), § 646A.604(9), and § 646A.604(10) — current official text, quoted passages, URL and access date appear above.
- Oregon Legislature, 2026 amended and repealed sections table — identifies the Chapter 646A sections amended in 2026; official URL appears in the verification note.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Oregon law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Oregon law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace