Oregon Data Breach Notification Law

The Oregon data breach notification law: 45 days and a wide data list

ORS 646A.604 runs a 45-day limit from the day a business discovers a breach or is told of it, and expects letters earlier when that is possible ¹.

Oregon protects passport numbers, biometric data, medical and health insurance details and online account logins on top of name plus Social Security, license or account number ¹. A data element with no name attached still counts if it would be enough for identity theft ¹.

Two provisions matter most to a small company:

• A 10-day vendor clock. Your service providers have 10 days from discovering a breach to tell you, plus an Attorney General notice of their own when more than 250 consumers, or an unknown number, are affected ¹. Make sure your managed IT and software contracts say so.
• No strings on credit monitoring. Any monitoring you offer cannot require a card number or a purchase to enroll ¹.

Attorney General and credit bureau notice

Once letters must go to more than 250 consumers, the Attorney General gets notice in writing or electronically ¹. No fixed date applies to it, only a reasonable time for the copy ¹. Some read the 45-day consumer limit onto it; the text does not. Mailing it alongside the consumer letters avoids the argument.

Past 1,000 consumers, the credit bureaus hear too ¹.

GLBA and HIPAA entities, and others following their federal regulator's rules, skip Oregon's consumer letters but still owe the Attorney General copies above 250 consumers ¹. A clinic will find the federal timeline in our HIPAA breach letter explainer.

The documented no-harm decision

Letters may be skipped when an appropriate investigation, or a consultation with police, leads the business to reasonably conclude consumers are unlikely to be harmed ¹. Oregon wants that conclusion written down and kept at least five years ¹.

Encryption and redaction take data outside the law, but encrypted files come back in if the key was taken ¹.

A separate duty requires any business holding personal information, and its vendors, to keep reasonable safeguards, safe disposal included ³. A security plan on paper is the easiest proof.

Penalties and enforcement

A violation is an unlawful practice under ORS 646.607, enforced by the Attorney General ¹. The Department of Consumer and Business Services director may also impose civil penalties of up to $1,000 per violation, capped at $500,000 per occurrence ². Private lawsuits are neither granted nor barred, which leaves them uncertain.

After an Oregon breach: first steps and other rules

While the attack runs, an insured Oregon business reports the claim first, files an FBI crime report through ic3.gov, and leaves the affected equipment alone until a forensic copy is made ⁵⁶⁸. Oregonians filed 12,477 complaints with IC3 in 2025 and reported about $193 million in losses ⁷.

1. Get a response firm or your regular IT vendor to contain the breach, and press vendors for the reports they owe within 10 days.
2. Check the policy before picking a lawyer or forensic firm; many carriers choose for you (common policy conditions).
3. Count consumers by home state. Washington and California set shorter deadlines than Oregon's; the full state deadline chart has the others.

Bigger data handlers face the Oregon Consumer Privacy Act as well, which covers businesses and nonprofits processing data on 100,000 or more Oregon consumers a year, or 25,000 or more when 25% or more of gross revenue comes from selling it ⁴. Our Portland IT support page covers local pricing.

ORS 646A.604 and this summary were last compared on October 13, 2026. An Oregon attorney, not this page, can give legal advice on what applies to you.