Meet ORS 646A breach notice and safeguard duties with confidence

ORS 646A.600 to 646A.628 is the Oregon Consumer Information Protection Act, Oregon's data breach notification and data security law. It requires anyone holding Oregon residents' personal information to maintain reasonable safeguards, notify affected people and, in larger breaches, the Attorney General. It also governs security freezes on credit reports and restricts printing or publicly displaying Social Security numbers. It is separate from the Oregon Consumer Privacy Act, which sits elsewhere in the same chapter.

Any covered entity must comply: a person, business, non-profit or public body that owns, licenses, maintains, stores, collects, processes or otherwise possesses Oregon residents' personal information in its business, vocation, occupation or volunteer activities. There is no revenue or headcount threshold. Vendors that process personal information for a covered entity also have duties, including keeping reasonable safeguards and reporting breaches to the covered entity within 10 days.

Covered entities must notify affected Oregon residents in the most expeditious manner possible, without unreasonable delay, and no later than 45 days after discovering or being told of the breach. Vendors must tell the covered entity within 10 days. If more than 250 consumers are notified, the Attorney General must also be told, and if more than 1,000 are affected, nationwide consumer reporting agencies must be notified. Delay is allowed only on a written law enforcement request.

Personal information means an Oregon resident's name combined with an unencrypted data element such as a Social Security number, driver licence or state ID number, passport number, financial account or card number with access codes, biometric data, health insurance identifiers, or medical information. A username or similar identifier with the password or other means needed to access the account also counts. Some data elements count on their own if they would enable identity theft.

A violation of ORS 646A.600 to 646A.628 is an unlawful trade practice under ORS 646.607, which the Oregon Attorney General can enforce. Separately, the Director of the Department of Consumer and Business Services can issue cease and desist orders and impose civil penalties of up to $1,000 per violation, with each day of a continuing violation counted separately and a maximum of $500,000 for any one occurrence.

ORS 646A.622 requires covered entities and vendors to develop, implement and maintain reasonable safeguards for the security, confidentiality and integrity of personal information, including secure disposal. An organisation is treated as compliant if it follows GLBA or HIPAA security rules where they apply, complies with a stronger law, or runs an information security programme with the administrative, technical and physical safeguards the section lists. Small businesses may scale safeguards to their size and risk.

ORS 646A does not name ISO 27001 or SOC 2, but the safeguards it lists, such as risk assessment, staff training, vendor selection, access reviews, patching, monitoring and secure disposal, closely match controls in both. An ISO 27001 or SOC 2 programme is therefore a strong basis for showing reasonable safeguards. Neither replaces the breach notification duties, which still need Oregon-specific timing, content and recipients.

Yes. ORS 646A is supported in OneClickComply today. It links Oregon's safeguard and breach readiness requirements to controls you may already meet for ISO 27001, SOC 2 or GDPR, with automated evidence collection, policy generation and continuous monitoring. OneClickComply does not certify compliance, but its in-house audit team can advise.