Makes high-risk automated decisions, in Oregon

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

ORS 646A.570, 646A.578 · Read the law's page

• Confirm you conduct business in Oregon, or produce a product or service used by Oregon residents, and process or sell personal data before relying on OCPA's scope in compliance planning.
• Do not sell precise geolocation data or process a known Oregon minor's (under-16) data for targeted advertising, sale, or profiling; both are prohibited outright as of January 1, 2026.
• If you manufacture motor vehicles, or are an affiliate of a manufacturer, and you control or process personal data obtained from a consumer's use of a motor vehicle or a component of one, treat OCPA as applying to you whatever the consumer-count thresholds; that has applied since September 26, 2025.

ORS 646A.574, 646A.576, 646A.578 · Read the law's page

• Give an Oregon consumer a means to confirm whether you process their personal data, disclose the categories processed, provide a portable copy, correct it, and delete it.
• Offer an Oregon consumer an opt-out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, decide an appeal within 45 days, and honor a consent revocation within 15 days.
• Allow an Oregon consumer or authorized agent to send you a signal, through a platform, technology or mechanism that meets the criteria of ORS 646A.578(5)(c), that indicates the consumer's preference to opt out of the sale of personal data or targeted advertising.

ORS 646A.586 · Read the law's page

• Conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to an Oregon consumer, including targeted advertising, processing sensitive data, selling personal data and profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, intrusion or other substantial injury (ORS 646A.586(1)).
• In each assessment, identify and weigh the benefits the processing may bring to you, the consumer, other stakeholders and the public against the risks to the consumer, taking into account the safeguards that mitigate them, and consider how deidentified data might reduce risks, consumers' reasonable expectations, the context of the processing and your relationship with the consumers (ORS 646A.586(2)).
• Keep every data protection assessment you conduct for at least five years (ORS 646A.586(6)).
• Provide to the Attorney General any data protection assessment the Attorney General requires that is relevant to an investigation under ORS 646A.589 (ORS 646A.586(3)).

ORS 659A.300(1), (5) · Read the law's page

• Do not subject an employee or prospective employee, directly or indirectly, to a genetic test (ORS 659A.300(1)).
• You may administer a genetic test only if the individual or the individual's representative grants informed consent in the manner ORS 192.535 provides and the test is administered solely to determine a bona fide occupational qualification (ORS 659A.300(5)).

ORS 659A.303 · Read the law's page

• Do not seek to obtain, obtain or use genetic information of an employee or prospective employee, or of a blood relative of either, to distinguish between or discriminate against the person or restrict any right or benefit otherwise due or available (ORS 659A.303(1)).