State Breach Law
Oregon Data Breach Notification Law
Or. Rev. Stat. §§ 646A.600 to 646A.628 • Effective 2007-10-01
Oregon gives you 45 days to notify affected residents. AG notification required too.
Notification deadline: 45 days
Enforcement: Oregon Attorney General
Overview
Oregon requires notification within 45 days of discovering a breach affecting personal information.
Who Must Be Notified
- • Affected Oregon residents
- • Oregon Attorney General (if 250+ affected)
Covered Data Types
Social Security number, Driver's license number, Financial account numbers, Passport number, Biometric data, Health information
Notification Requirements
- • Written notice
- • Must include breach description
- • Contact information required
Is your business exposed?
Exemptions
- • Encrypted data
- • Good faith acquisition
Penalties
Up to $1,000 per violation, $500,000 max per breach
If You Experience a Breach
- 1.
Notify AG and residents within 45 days
Official Source
https://www.doj.state.or.us/Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required