1. Home
  2. State breach laws
  3. Oregon

Oregon data breach notification law

What Oregon requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Or. Rev. Stat. §§ 646A.600–646A.628 (Oregon Consumer Information Protection Act), notice requirements at § 646A.604 and penalties at § 646A.624.

45 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Oregon's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Oregon breach filings →

Requirements in detail

Statute
Or. Rev. Stat. §§ 646A.600–646A.628 (Oregon Consumer Information Protection Act), notice requirements at § 646A.604 and penalties at § 646A.624
Deadline to notify residents
In the most expeditious manner possible and without unreasonable delay, but no later than 45 days after discovering or being notified of the breach. Notice may be delayed only if a law enforcement agency determines it would impede a criminal investigation and asks for the delay in writing.
Attorney General notification
Yes, when more than 250 Oregon consumers must be notified. Organizations exempt from the state notice rules because they follow federal rules (such as HIPAA or Gramm-Leach-Bliley) must still send the Attorney General a copy of their notice within a reasonable time if more than 250 consumers are affected. Vendors must notify the business they work for within 10 days. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 consumers are affected.
Penalties
A violation is an unlawful trade practice that the Attorney General can enforce. The Director of the Department of Consumer and Business Services may also impose penalties of up to $1,000 per violation, with each day of a continuing violation counted separately, capped at $500,000 per occurrence, and may order compensation to injured consumers.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Oregon's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Oregon has no law limiting breach lawsuits for organizations that maintain a security program.

Oregon breach notification FAQ

What is the data breach notification deadline in Oregon?

In the most expeditious manner possible and without unreasonable delay, but no later than 45 days after discovering or being notified of the breach. Notice may be delayed only if a law enforcement agency determines it would impede a criminal investigation and asks for the delay in writing. The governing law is Or. Rev. Stat. §§ 646A.600–646A.628 (Oregon Consumer Information Protection Act), notice requirements at § 646A.604 and penalties at § 646A.624.

Does Oregon require notifying the Attorney General of a data breach?

Yes, when more than 250 Oregon consumers must be notified. Organizations exempt from the state notice rules because they follow federal rules (such as HIPAA or Gramm-Leach-Bliley) must still send the Attorney General a copy of their notice within a reasonable time if more than 250 consumers are affected. Vendors must notify the business they work for within 10 days. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 consumers are affected.

What are the penalties for failing to report a data breach in Oregon?

A violation is an unlawful trade practice that the Attorney General can enforce. The Director of the Department of Consumer and Business Services may also impose penalties of up to $1,000 per violation, with each day of a continuing violation counted separately, capped at $500,000 per occurrence, and may order compensation to injured consumers.

Can individuals sue over a data breach in Oregon?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Oregon?

Oregon's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Oregon limit breach lawsuits for companies with a cybersecurity program?

No. Oregon has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Oregon Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →