Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Oregon |
|---|---|
| Statute citation | Or. Rev. Stat. §§ 646A.600-646A.628 (Oregon Consumer Information Protection Act) (amended |
| Individual notice timing | 45 days Oregon requires covered entities (including businesses) to notify affected consumers within 45 |
| Attorney general notice | Yes Oregon requires Attorney General notification when a breach affects more than 250 consumers; |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Oregon 'breach of security' means an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains or possesses. 'Breach of security' does not include an inadvertent acquisition of personal information by a person or the person's employee or agent if the personal information is not used in violation of applicable law or in a manner that harms or poses an actual threat to the security, confid |