Law / United States / 
Oregon
Oregon Consumer Privacy Act, data protection assessments
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- DPIA, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to an Oregon consumer, including targeted advertising, processing sensitive data, selling personal data and profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, intrusion or other substantial injury (ORS 646A.586(1)).
- In each assessment, identify and weigh the benefits the processing may bring to you, the consumer, other stakeholders and the public against the risks to the consumer, taking into account the safeguards that mitigate them, and consider how deidentified data might reduce risks, consumers' reasonable expectations, the context of the processing and your relationship with the consumers (ORS 646A.586(2)).
- Keep every data protection assessment you conduct for at least five years (ORS 646A.586(6)).
- Provide to the Attorney General any data protection assessment the Attorney General requires that is relevant to an investigation under ORS 646A.589 (ORS 646A.586(3)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Log retention
Five years is a minimum for each assessment; the section sets no maximum and states no date from which the period runs.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer (646A.586(1)), weighing the benefits of the processing against the risks as the controller's safeguards mitigate them (646A.586(2)), and must retain every assessment for at least five years (646A.586(6)). The Attorney General may require a controller to provide any assessment relevant to an investigation under 646A.589 and may evaluate it for compliance (646A.586(3)); an assessment is confidential and exempt from the public records law (646A.586(7)). The section names no data fields beyond that weighing of benefits and risks, so the contents are the decision basis only. The section has no scope clause; the business and consumer reach sits in 646A.572(1)(a) and the definition of consumer in 646A.570(7), which this row does not cite, so no hook is taken. Two nearby clauses are not logs: 646A.576(7)(a) is one of two routes to honor a deletion request, so keeping a record of the request is an option, and 646A.572(7) puts the burden of demonstrating an exemption on a controller that claims one, which allocates proof and names no record.
- Kind
- Explicit
- As of
- Provision
- ORS 646A.586(1), (3) and (6) (documented data protection assessments)
- Trigger
- personal_data_processing
What this law does
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, processing sensitive data, selling personal data and some profiling. The Attorney General may require a controller to provide any data protection assessment that is relevant to an investigation the Attorney General conducts under ORS 646A.589.
A controller must retain all of its data protection assessments for at least five years. A data protection assessment is confidential and is not subject to disclosure under Oregon's public records law. The assessment requirements apply only to processing activities that occur on and after , and are not retroactive.
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web, deploys a chatbot, processes biometric data, processes voice recordings, trains models or makes high-risk automated decisions.