Processes personal data, in Oregon

ORS 646A.620(1)(a) to (c) · Read the law's page

• Do not print a consumer's Social Security number on mail to the consumer that is material the consumer did not request, or on any documentation the consumer requested for a transaction or service, unless the number is redacted (ORS 646A.620(1)(a)).
• Do not print a consumer's Social Security number on any card the consumer needs to access products or services you provide (ORS 646A.620(1)(b)).
• Do not publicly post or publicly display a consumer's Social Security number, meaning communicate it or otherwise make it available to the public, unless it is redacted (ORS 646A.620(1)(c)).

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

ORS 646A.593 · Read the law's page

• If you are a business entity or part of one that collects and sells or licenses brokered personal data to another person (a resident individual's name, address, date or place of birth, mother's maiden name, biometric information, Social Security or other government identification number, or other information that can reasonably be associated with the individual), register with the Department of Consumer and Business Services before you collect, sell or license that data within Oregon.
• You need not register if your collection, sale or licensing involves only publicly available information related to an individual's business or profession, publicly available information in a health or safety alert service, information lawfully available from federal, state or local government records, journals, books, periodicals, newspapers, magazines, news media or educational works, developing or maintaining an electronic commerce service or software, directory assistance or directory information services for a telecommunications carrier, or a single or occasional sale of business assets outside the ordinary conduct of the business.
• You are not a data broker for information about a resident individual who is or was your customer, subscriber or user, your employee or agent or in a contractual relationship with you, your investor or donor, or in another relationship with you of a similar nature.
• You are also not a data broker if you perform services for, act on behalf of or act as an agent of a business entity that holds one of those relationships with the individual.
• You are not a data broker to the extent your activities are subject to regulation under the federal Fair Credit Reporting Act as a consumer reporting agency, a person that furnishes information to one or a user of a consumer report, or under Title V of the Gramm-Leach-Bliley Act as a financial institution, an affiliate or a nonaffiliated third party.
• To register, submit on the department's form your name, street address, telephone number, primary website and email address, pay the fee the department sets by rule, and declare whether a resident individual may opt out of all or part of your collection, sale or licensing of brokered personal data, which activities or data the opt-out covers, how to exercise it, and whether another person may exercise it on the individual's behalf.
• Keep your registration current: it is valid only until December 31 of the year in which the department approves it.

ORS 646A.570(11), 646A.583 · Read the law's page

• If you hold deidentified data, take reasonable measures to ensure that it cannot be associated with an individual (ORS 646A.583(1)(a)(A)).
• Publicly commit to maintaining and using the deidentified data without attempting to reidentify it, except that you may attempt to reidentify it solely to test your deidentification methods (ORS 646A.583(1)(a)(B) and (1)(c)).
• Enter into a contract with each recipient of the deidentified data requiring the recipient to comply with your obligations under ORS 646A.570 to 646A.589 (ORS 646A.583(1)(a)(C)).
• If you disclose deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (ORS 646A.583(1)(b)).

ORS 646A.570(3), (18) · Read the law's page

• Obtain a lawful basis and, for sensitive data, opt-in consent before processing an Oregon consumer's genetic or biometric data.
• Treat facial mapping or facial geometry generated or used to identify a specific Oregon consumer as covered biometric data, even when derived from a photograph, video, or audio recording. Oregon's exclusion does not reach data generated or used for that purpose.

ORS 646A.570, 646A.578 · Read the law's page

• Confirm you conduct business in Oregon, or produce a product or service used by Oregon residents, and process or sell personal data before relying on OCPA's scope in compliance planning.
• Do not sell precise geolocation data or process a known Oregon minor's (under-16) data for targeted advertising, sale, or profiling; both are prohibited outright as of January 1, 2026.
• If you manufacture motor vehicles, or are an affiliate of a manufacturer, and you control or process personal data obtained from a consumer's use of a motor vehicle or a component of one, treat OCPA as applying to you whatever the consumer-count thresholds; that has applied since September 26, 2025.

ORS 646A.574, 646A.576, 646A.578 · Read the law's page

• Give an Oregon consumer a means to confirm whether you process their personal data, disclose the categories processed, provide a portable copy, correct it, and delete it.
• Offer an Oregon consumer an opt-out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, decide an appeal within 45 days, and honor a consent revocation within 15 days.
• Allow an Oregon consumer or authorized agent to send you a signal, through a platform, technology or mechanism that meets the criteria of ORS 646A.578(5)(c), that indicates the consumer's preference to opt out of the sale of personal data or targeted advertising.

ORS 646A.586 · Read the law's page

• Conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to an Oregon consumer, including targeted advertising, processing sensitive data, selling personal data and profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, intrusion or other substantial injury (ORS 646A.586(1)).
• In each assessment, identify and weigh the benefits the processing may bring to you, the consumer, other stakeholders and the public against the risks to the consumer, taking into account the safeguards that mitigate them, and consider how deidentified data might reduce risks, consumers' reasonable expectations, the context of the processing and your relationship with the consumers (ORS 646A.586(2)).
• Keep every data protection assessment you conduct for at least five years (ORS 646A.586(6)).
• Provide to the Attorney General any data protection assessment the Attorney General requires that is relevant to an investigation under ORS 646A.589 (ORS 646A.586(3)).

ORS 646A.589 · Read the law's page

• Expect OCPA violations to be enforced exclusively by the Oregon Attorney General, never by a private plaintiff.
• Do not expect notice or an opportunity to cure before the Attorney General acts; since January 1, 2026 the Attorney General may proceed directly to an enforcement action.

ORS 192.531 to 192.549 · Read the law's page

• If you obtain genetic information from an individual or from an individual's DNA sample (by performing or getting the results of a genetic test), first obtain the informed consent of the individual or the individual's representative, unless an exception in ORS 192.535(1) applies (ORS 192.535(1)).
• Maintain the confidentiality of an individual's genetic information and DNA sample, and protect them from unauthorized disclosure or misuse, if you are authorized to obtain, retain or use them (ORS 192.537(1)).
• Do not retain another individual's genetic information or DNA sample without first obtaining authorization from the individual or the individual's representative, unless an exception in ORS 192.537(3) applies; subsections (3) to (8) of ORS 192.537 apply only to a DNA sample or genetic information that is coded, identified or identifiable (ORS 192.537(3), (10)).
• Destroy a DNA sample from which genetic information has been obtained promptly on the individual's specific request, subject to the exceptions in ORS 192.537(4), and destroy a research sample (other than for anonymous research) promptly on completion of the project or withdrawal of the individual (ORS 192.537(4), (5)).
• Use an individual's DNA sample or genetic information derived from a biological specimen or clinical health information for anonymous or coded research only if the individual consented to the specific project or to genetic research generally, or was notified under ORS 192.538 and did not object (ORS 192.537(2)).
• Let an individual or the individual's representative, promptly on request, inspect, request correction of and obtain genetic information from the individual's records (ORS 192.537(7)).
• Do not disclose, or comply with a subpoena to disclose, the identity of an individual on whom a genetic test was performed, or genetic information that permits identification of the individual or a blood relative, unless an exception in ORS 192.539(1) applies, including the individual's signed consent on the form the Oregon Health Authority prescribes; the bar applies to any redisclosure (ORS 192.539(1), (2)).
• If you are a health care provider that is a covered entity, notify an individual no later than when you obtain a biological specimen or clinical health information that it may be disclosed or retained for anonymous or coded research, and let the individual mark a request that it not be (ORS 192.538(1), (3), (4)).

ORS 646A.604 · Read the law's page

• Notify each affected Oregon consumer of a breach of security, including one you learn of through a vendor, in the most expeditious manner possible and not later than 45 days after discovering or receiving notification of the breach, and notify the Oregon Attorney General as well once more than 250 Oregon consumers are notified (ORS 646A.604(1), (3)).
• If you are a vendor that discovers a breach of security or has reason to believe one has occurred, notify each covered entity you have a contract with as soon as is practicable and not later than 10 days after discovering the breach or having reason to believe it occurred, and if you contract with another vendor that serves a covered entity, notify that vendor the same way (ORS 646A.604(2)).

ORS 746.135 · Read the law's page

• If you ask an applicant for insurance to take a genetic test in connection with an application, reveal the use of the test to the applicant and obtain the applicant's specific authorization on the form the Director of the Department of Consumer and Business Services adopts by rule (ORS 746.135(1)).
• Do not use favorable genetic information to induce the purchase of insurance (ORS 746.135(2)).
• Do not use genetic information to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms and conditions of or otherwise affect any policy for hospital or medical expenses (ORS 746.135(3)).
• Do not use genetic information about a blood relative to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms and conditions of or otherwise affect any policy of insurance (ORS 746.135(4)).

ORS 746.665(1)(i) · Read the law's page

• If you are an insurance licensee or insurance-support organization, disclose personal or privileged information about an individual for an actuarial or research study only if no individual may be identified in any resulting actuarial or research report (ORS 746.665(1)(i)(A)).
• Make sure materials that allow the individual to be identified are returned or destroyed as soon as they are no longer needed (ORS 746.665(1)(i)(B)).
• Have the actuarial or research organization agree not to disclose the information unless the disclosure would otherwise be permitted by ORS 746.665 if made by a licensee or insurance-support organization (ORS 746.665(1)(i)(C)).
• This condition does not apply to a health insurer (ORS 746.609).