Oregon has had a comprehensive consumer privacy law since July 2024, and most small businesses in the state are not covered by it. That’s the short answer, and it’s worth saying first because a fair amount of what gets sold under the heading “Oregon privacy compliance” is aimed at companies far larger than a 30-person firm in Tigard. The longer answer is that two other things do apply to you whatever your size: the state’s data-breach notification law, which has been on the books in some form since 2007, and the contracts and insurance questionnaires that increasingly ask what you do with customer data. Here’s how to sort out which rules are yours, in plain terms. We’re an IT company, not a law firm, so treat this as orientation and confirm the details that matter with counsel.

Who the Oregon Consumer Privacy Act covers

The OCPA (Senate Bill 619) applies to a business that, in a calendar year, controls or processes the personal data of 100,000 or more Oregon consumers, not counting data used only to complete a payment, or the data of 25,000 or more consumers while making 25% or more of its revenue from selling personal data. There’s no revenue threshold on its own. “Consumer” means an Oregon resident acting as an individual or household, so your business customers’ employee contact records don’t count toward the number.

A dental practice with 6,000 patients, a distributor with 400 accounts, a winery with a 20,000-name mailing list: none of them reach the threshold. A regional retailer with an e-commerce site and a loyalty program might. Nonprofits were given an extra year and have been covered since July 1, 2025.

If you’re under the threshold, you can stop worrying about the OCPA’s mechanics. You should keep reading, because the breach law is a different matter and the practices below are what customers and insurers now expect anyway.

What it requires if you are covered

The law gives Oregonians a set of rights over their data and puts corresponding duties on the business:

  • Access, correction, deletion and portability. Consumers can ask what you hold about them, fix it, delete it or get a copy. You have 45 days to respond, extendable once.
  • A list of specific third parties. Oregon’s law is unusual in letting a consumer ask for the actual names of the third parties you’ve disclosed their data to, not just categories.
  • Opt-outs. Consumers can opt out of targeted advertising, the sale of their data and profiling that produces significant decisions. Since January 1, 2026 you also have to honor universal opt-out signals such as Global Privacy Control sent by the browser, which means your website has to recognize the signal, not just offer a link.
  • Opt-in for sensitive data. Health, precise location, racial or ethnic origin, religion, sexual orientation, immigration status and data about children require consent before processing, not an opt-out after the fact.
  • A privacy notice that says what you collect, why, who gets it, and how to exercise the rights above.
  • Data protection assessments for higher-risk processing such as targeted advertising, selling data or handling sensitive data.
  • Contracts with your processors, meaning the vendors who handle data on your behalf, that bind them to the same rules.

Enforcement sits with the Oregon Department of Justice. The 30-day cure period that let businesses fix a problem before penalties expired at the start of 2026, and penalties can reach $7,500 per violation. There’s no private right of action, so the risk is the Attorney General, not a class action. A 2025 amendment also banned the sale of precise geolocation data and the data of consumers under 16 outright, effective January 1, 2026.

The law that applies to everyone: breach notification

Oregon’s Consumer Information Protection Act (ORS 646A.600 and following) has no size threshold. If you hold personal information about Oregon residents, a name combined with a Social Security number, driver’s license number, financial account number, medical information or login credentials, and that information is breached, you have obligations:

  • Notify affected consumers within 45 days of discovering the breach.
  • Notify the Oregon Attorney General if more than 250 Oregonians are affected.
  • Vendors must tell you within 10 days of discovering a breach of data they hold for you.
  • Maintain reasonable safeguards for the data in the first place; the law names an information security program as the standard.

The practical consequence is that the 45-day clock starts from discovery, and discovery depends on whether anyone is looking. A business with security logging and monitoring finds out on day one and can scope the incident. A business without it often finds out from a customer, weeks late, with no way to tell whose records were touched, which usually means notifying everyone.

What this looks like in practice for a small business

Whether or not the OCPA applies, the same five pieces of groundwork satisfy the breach law, the insurance questionnaire and the customer who sends a security addendum:

  1. Know what you hold and where. A one-page data inventory: what personal information you collect, which systems it lives in, who can see it, and how long you keep it. Most businesses are surprised by how much sits in email and spreadsheets.
  2. Keep less. A retention schedule that deletes what you no longer need shrinks every obligation above. Data you don’t have can’t be breached or requested.
  3. Write a privacy notice you can live up to. Even below the threshold, your website needs one if you collect anything through forms, run analytics or advertise. Say what you actually do; the notice is a promise.
  4. Protect it. Multi-factor authentication, encryption on laptops and backups, access limited by role, and monitoring that would notice a breach. These are the “reasonable safeguards” regulators and carriers mean.
  5. Plan the bad day. A one-page incident response plan with the 45-day clock, the vendor 10-day clock and your attorney’s number on it.

If you do cross the OCPA threshold, add the formal pieces: the rights-request process, the opt-out and Global Privacy Control handling on the website, processor contracts and the assessments. That’s work for counsel and a privacy specialist. For our clients who need it, we work with a compliance partner on the policy and assessment side and handle the technical controls, the monitoring and the evidence ourselves, which keeps the two halves consistent.

A quick self-check

  • Could you produce a list of every system holding customer personal data in an afternoon?
  • Would you know within 24 hours if someone copied a customer database?
  • Does your website’s privacy notice describe what you actually collect, including analytics and ad pixels?
  • Do your vendor contracts say what happens when the vendor is breached?
  • Do you know roughly how many Oregon residents’ records you process per year, and whether that number is near 100,000?

Four yeses means you’re in good shape for the law that applies to you. Fewer than that is a short project, not a crisis, and it’s the same project whether the OCPA ever reaches your size or not.