What Oregon laws should a Portland business know?
Oregon is unusual: its law does not just say what to do after a breach. It says you need a security program before one.
Reasonable safeguards, ORS 646A.622
Under ORS 646A.622, a business that holds Oregon residents' personal information, and any vendor that handles it, must develop, implement, and maintain reasonable safeguards to protect it. The statute lists what that looks like, and most of it is leadership work rather than technology:
- Name one or more people to coordinate the security program.
- Identify reasonably foreseeable internal and external risks, at regular intervals.
- Check whether your safeguards control those risks.
- Train employees in security practices, at regular intervals.
- Choose service providers that can protect the data, and require it by contract.
- Review who has access, and adjust the program as the business changes.
A small business is treated as compliant if its safeguards are appropriate for its size and complexity, the nature of its activities, and the sensitivity of the data it holds. That is a lower bar, but it still means a written, working program. A vCISO is the person who builds and runs it.
Breach notification, ORS 646A.604
Under ORS 646A.604, affected consumers must be notified no later than 45 days after a breach is discovered. If more than 250 consumers are affected, the Oregon Attorney General must be notified too. A vendor that suffers a breach must tell its client within 10 days. Without a written incident response plan, those days go fast.
Oregon Consumer Privacy Act
The Oregon Consumer Privacy Act took effect July 1, 2024. It applies to businesses that, in a calendar year, control or process the personal data of at least 100,000 Oregon consumers, or of 25,000 or more while earning over 25% of revenue from selling personal data. Most small businesses fall below those numbers, but customer-facing companies with large lists can cross them. Since January 1, 2026, the Attorney General no longer has to offer a chance to fix a violation before acting, and selling precise geolocation data or the data of consumers under 16 is prohibited.
Vancouver and Southwest Washington
Clark County businesses fall under Washington law. Under RCW 19.255.010, affected Washington residents must generally be notified within 30 calendar days of discovering a breach, and the Attorney General if more than 500 residents are affected. The My Health My Data Act also covers consumer health data well beyond medical records.
Plenty of businesses here sit on both sides of the river: an office in Vancouver, customers or staff in Portland. One security program can satisfy both states, as long as the incident plan accounts for both clocks.
This is not legal advice. CyberCascadia is not a law firm. We help you build the security program these laws expect and work with your attorney on the legal questions.