close
close
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Oregon Privacy Law

OR

Oregon (OCPA)

Last updated

OCPA Enacted, in effect

Who this affects: This page tracks Oregon’s OCPA, which governs controllers and processors.

Who it applies to: Entities that do business in Oregon or serve its residents, and meet: 100,000+ consumers, or 25,000+ consumers and 25%+ of gross revenue from selling data, or other thresholds (see below).

Content on this page is not legal advice This page aggregates publicly cited regulatory facts for informational purposes only. It is not legal advice, and DataGrail is not responsible for decisions made in reliance on it. Consult qualified counsel for your specific compliance obligations.
Must, Can't, Should OCPA Timeline
July 1, 2024
Effective ↗
Attorney General
Enforced by ↗
$7,500
Maximum penalty per violation ↗
None
Private right of action ↗

The law, in plain English

Must · Can’t · Should

OCPA, distilled to what actually changes your week. Read one column to know your floor, your hard limits, and the further obligations and good practices worth planning for.

Must

  • Answer rights requests within 45 days; extend 45 more only if reasonably necessary, telling the consumer in the first 45 days. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.576 “Respond to a request from a consumer without undue delay and not later than 45 days after receiving the request. The controller may extend the period within which the controller responds by an additional 45 days if the extension is reasonably necessary to comply with the consumer’s request, taking into consideration the complexity of the request and the number of requests the consumer makes.” Read the statute OR-646A.576 “A controller that intends to extend the period for responding shall notify the consumer within the initial 45-day response period and explain the reason for the extension.” Read the statute
  • Honor opt-out preference signals (such as GPC) for sale and targeted ads, and post a clear and conspicuous opt-out webpage link. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.578 “Allow a consumer or authorized agent to send a signal to the controller that indicates the consumer’s preference to opt out of the sale of personal data or targeted advertising under ORS 646A.574 (1)(d) by means of a platform, technology or mechanism” Read the statute OR-646A.578 “Provide a clear and conspicuous link to a webpage where the consumer or an authorized agent may opt out from a controller’s processing of the consumer’s personal data as described in ORS 646A.574 (1)(d) or, solely if the controller does not have a capacity needed for linking to a webpage, provide another method the consumer can use to opt out” Read the statute
  • Conduct and document a data protection assessment for each heightened-risk processing activity and keep it at least five years. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.586 “A controller shall conduct and document a data protection assessment for each of the controller’s processing activities that presents a heightened risk of harm to a consumer.” Read the statute OR-646A.586 “A controller shall retain for at least five years all data protection assessments the controller conducts under this section.” Read the statute

Can't

  • Process sensitive data without consent or, for a known child, other than in accordance with COPPA. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.578 “Process sensitive data about a consumer without first obtaining the consumer’s consent or, if the controller knows the consumer is a child, without processing the sensitive data in accordance with the Children’s Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq. and the regulations, rules and guidance adopted under the Act, all as in effect on January 1, 2024” Read the statute
  • Use a consumer's data for targeted ads or significant-decision profiling if you know or willfully disregard they are under 16. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.578 “Process a consumer's personal data for the purposes of targeted advertising or of profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance if the controller has actual knowledge that, or willfully disregards whether, the consumer is under 16 years of age.” Read the statute
  • Require a new account to exercise rights, or discriminate for exercising them, beyond bona fide loyalty or discount programs. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.576 “A controller may not require a consumer to create an account for the purpose described in subsection (1) of this section, but the controller may require the consumer to use an account the consumer created previously.” Read the statute OR-646A.578 “Discriminate against a consumer that exercises a right provided to the consumer under ORS 646A.570 to 646A.589 by means such as denying goods or services, charging different prices or rates for goods or services or providing a different level of quality or selection of goods or services to the consumer. (3) Subsections (1) and (2) of this section do not: (a) Require a controller to provide a good or service that requires personal data from a consumer that the controller does not collect or maintain; or (b) Prohibit a controller from offering a different price, rate, level of quality or selection of goods or services to a consumer, including an offer for no fee or charge, in connection with a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discount or club card program” Read the statute

Should

  • Bind processors by contract to delete or return data at your direction, prove compliance on request, and bind subcontractors. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.581 “The processor shall enter into a contract with the controller that governs how the processor processes personal data on the controller's behalf.” Read the statute OR-646A.581 “Require the processor to delete the personal data or return the personal data to the controller at the controller's direction or at the end of the provision of services” Read the statute OR-646A.581 “Require the processor to make available to the controller, at the controller's request, all information the controller needs to verify that the processor has complied with all obligations the processor has under ORS 646A.570 to 646A.589” Read the statute OR-646A.581 “Require the processor to enter into a subcontract with a person the processor engages to assist with processing personal data on the controller's behalf and in the subcontract require the subcontractor to meet the processor's obligations under the processor's contract with the controller” Read the statute
  • Accept opt-outs without authentication, and honor authorized agents' opt-outs when you can verify identity and authority. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.576 “Comply with a request under ORS 646A.574 (1)(d) to opt out of the controller's processing of the consumer's personal data without requiring authentication” Read the statute OR-646A.576 “A controller shall comply with an opt-out request the controller receives from an authorized agent if the controller can verify, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf.” Read the statute
  • Build a consent-revocation workflow that stops processing as soon as practicable and no later than 15 days after revocation. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. OR-646A.578 “Once the consumer revokes consent, the controller shall cease processing the personal data as soon as is practicable, but not later than 15 days after receiving the revocation.” Read the statute

These are the highlights we judge most important, not everything OCPA requires. The comprehensive law section below covers the full detail, fact by fact, with the statutory text behind every one.

The comprehensive law

Oregon Consumer Privacy Act

OCPA (SB 619) is Oregon’s comprehensive privacy law. Every fact was extracted from the primary statute by the DataGrail regulation engine and is grounded to the cited source. Scan the facts; the exact statutory text sits one click away on each source link.

Status
Enacted, in effect
Archived excerpt — the text we read 646A.572 Scope and application; exclusions. (1)(a) ORS 646A.570 to 646A.589 apply to any person that conducts business in this state, or that provides products or services to residents of this state, and that during a calendar year, controls or processes: (A) The personal data of 100,000 or more consumers, other than personal data controlled or proc… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source

Corroborated by Privacy-law tracker

Effective
July 1, 2024
For 501(c)(3) tax-exempt nonprofit organizations the Act applies from July 1, 2025 (2023 Or. Laws c.369 § 13). Archived excerpt — the text we read …ther applicable law or regulation satisfies the requirements of this section if the data protection assessment is reasonably similar in scope and effect to a data protection assessment conducted under this section. (5) Requirements that apply to a data protection assessment under this section apply only to processing activities that occur on and after July 1, 2024, and are not retroactive. (6) A controller shall retain for at least five years all data protection assessments the controller conducts under this section. (7) A data protection assessment is confidential and is not subject to disclosure under… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
Signed
July 18, 2023
“Approved by the Governor July 18, 2023” View the source
Enforced by
Attorney General
Oregon Attorney General Archived excerpt — the text we read … the Attorney General or another person under other applicable provisions of law. A claim available under another provision of law may be joined to the Attorney General’s claim under subsection (4) of this section. (7) The Attorney General has exclusive authority to enforce the provisions of ORS 646A.570 to 646A.589. ORS 646A.570 to 646A.589, or any other laws of this state, do not create a private right of action to enforce a violation of ORS 646A.570 to 646A.589. [2023 c.369 §9; 2023 c.369 §11; 2024 c.64 §§1,2] Note: Sections 4 t… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
Maximum penalty per violation
$7,500
“seek a civil penalty of not more than $7,500 for each violation of ORS 646A.570 to 646A.589” View the statute

Corroborated by Regulator guidance

Right to cure
30 days (lapsed Jan 1, 2026)
2025 Or. Laws c.417 § 5(1) (Note following ORS 646A.589; repealed July 1, 2026) The general cure ended Jan 1, 2026; a carve-out for certain educational broadcast stations ended July 1, 2026. Archived excerpt — the text we read … Before bringing an action under ORS 646A.589 (4), the Attorney General shall notify a controller of a violation of ORS 646A.570 to 646A.589 if the Attorney General determines that the controller can cure the violation. If the controller fails to cure the violation within 30 days after receiving the notice of the violation, the Attorney General may bring the action without further notice. (2) Beginning January 1, 2026, subsection (1) of this section applies only to a controller that is a noncommercial educational broadcast station, as defined in 47 U.S.C. 397, as in effect on the effective date of this … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
Private right of action
No private right of action.
Archived excerpt — the text we read …y General’s claim under subsection (4) of this section. (7) The Attorney General has exclusive authority to enforce the provisions of ORS 646A.570 to 646A.589. ORS 646A.570 to 646A.589, or any other laws of this state, do not create a private right of action to enforce a violation of ORS 646A.570 to 646A.589. [2023 c.369 §9; 2023 c.369 §11; 2024 c.64 §§1,2] Note: Sections 4 to 6, chapter 417, Oregon Laws 2025, provide: Sec. 4. Section 5 of this 2025 Act is added to and made a part of ORS 646A.570 to 646A.589. [2025 c.417 … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source

Corroborated by Privacy-law tracker Regulator guidance

Universal opt-out signal
Required
Archived excerpt — the text we read …of the consumer’s personal data as described in ORS 646A.574 (1)(d) or, solely if the controller does not have a capacity needed for linking to a webpage, provide another method the consumer can use to opt out; and (c) Allow a consumer or authorized agent to send a signal to the controller that indicates the consumer’s preference to opt out of the sale of personal data or targeted advertising under ORS 646A.574 (1)(d) by means of a platform, technology or mechanism that: (A) Does not unfairly disadvantage another controller; (B) Does not use a default setting but instead requires the consumer or authorized agent to make an affirmative, voluntary and unambiguous choice to opt out; (C) Is consumer friendly and easy for an average consumer to use; (D) Is as consistent as possible with similar platforms, technologies or mechanisms required under federal or state laws or regulations; and (E) Enables the controller to accurately determine whether the consumer is a resident of this state and has made a legitimate request under ORS 646A.576 to opt out as described in ORS 646A.574 (1)(d). (6) If a consumer or authorized agent uses a method described in subsection (5) of this section to opt out of a controller’s processing of the consumer’s personal data under ORS 646A.574 (1)(d) and the decision conflic… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source

Who it applies to

Entities that do business in Oregon or serve its residents, and meet: 100,000+ consumers, or 25,000+ consumers and 25%+ of gross revenue from selling data, or other thresholds (see full text)

What the law gives consumers

  • Right to access Also includes a copy of all of the consumer's personal data that the controller has processed or is processing (646A.574(1)(a)(C)). Archived excerpt — the text we read …nal data; conditions under which consumer may opt out of personal data processing; format for providing copy of personal data to consumer. (1) Subject to ORS 646A.576, a consumer may: (a) Obtain from a controller: (A) Confirmation as to whether the controller is processing or has processed the consumer’s personal data and the categories of personal data the controller is processing or has processed; (B) At the controller’s option, a list of specific third parties, other than natural persons, to which the controller has disclosed: (i) The consumer’s personal data; or (ii) Any personal data; and (C) A copy of al… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right to correct Archived excerpt — the text we read …sons, to which the controller has disclosed: (i) The consumer’s personal data; or (ii) Any personal data; and (C) A copy of all of the consumer’s personal data that the controller has processed or is processing; (b) Require a controller to correct inaccuracies in personal data about the consumer, taking into account the nature of the personal data and the controller’s purpose for processing the personal data; (c) Require a controller to delete personal data about the consumer, including personal data the consumer provided to the controller, personal data the controller obtained from another source and derived data; or (d)… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right to delete (limited) For data obtained from another source, the controller may delete it (keeping only a record and minimal data to keep it deleted) or opt the consumer out of non-exempt processing (ORS 646A.576(7)). Archived excerpt — the text we read … processing; (b) Require a controller to correct inaccuracies in personal data about the consumer, taking into account the nature of the personal data and the controller’s purpose for processing the personal data; (c) Require a controller to delete personal data about the consumer, including personal data the consumer provided to the controller, personal data the controller obtained from another source and derived data; or (d) Opt out from a controller’s processing of personal data of the consumer that the controller processes for any of the following purposes: (A) Targeted advertising; (B) Selling the personal data; or (C) Profil… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right to data portability Archived excerpt — the text we read …ng the consumer in furtherance of decisions that produce legal effects or effects of similar significance. (2) A controller that provides a copy of personal data to a consumer under subsection (1)(a)(C) of this section shall provide the personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the personal data to another person without hindrance. (3) This section does not require a controller to disclose the controller’s trade secrets, as defined in ORS 646.461. [2023 c.369 §3] 646A.575 [2011 c.393 §1; renumbered 646A.820 in 2023] Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right to opt out of sale Archived excerpt — the text we read … (c) Require a controller to delete personal data about the consumer, including personal data the consumer provided to the controller, personal data the controller obtained from another source and derived data; or (d) Opt out from a controller’s processing of personal data of the consumer that the controller processes for any of the following purposes: (A) Targeted advertising; (B) Selling the personal data; or (C) Profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance. (2) A controller that provides a copy of personal data to a consumer under subsection (1)(a)(C)… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right to opt out of targeted advertising Archived excerpt — the text we read …al data the controller obtained from another source and derived data; or (d) Opt out from a controller’s processing of personal data of the consumer that the controller processes for any of the following purposes: (A) Targeted advertising; (B) Selling the personal data; or (C) Profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance. (2) A controller that provides a copy of personal data to a con… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right to opt out of profiling for significant decisions Archived excerpt — the text we read …d data; or (d) Opt out from a controller’s processing of personal data of the consumer that the controller processes for any of the following purposes: (A) Targeted advertising; (B) Selling the personal data; or (C) Profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance. (2) A controller that provides a copy of personal data to a consumer under subsection (1)(a)(C) of this section shall provide the personal data in a portable and, to the extent technically feasible, readily usable for… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Sensitive data: opt-in consent required Archived excerpt — the text we read …personal data for purposes that are not reasonably necessary for and compatible with the purposes the controller specified in subsection (1)(a) of this section, unless the controller obtains the consumer’s consent. (b) Process sensitive data about a consumer without first obtaining the consumer’s consent or, if the controller knows the consumer is a child, without processing the sensitive data in accordance with the Children’s Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq. and the regulations, rules and g… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right to appeal Archived excerpt — the text we read …denies a request under this subparagraph, the controller shall notify the consumer that the controller believes the request is fraudulent, stating in the notice that the controller will not comply with the request. (6) A controller shall establish a process by means of which a consumer may appeal the controller’s refusal to take action on a request under subsection (1) of this section. The controller’s process must: (a) Allow a reasonable period of time after the consumer receives the controller’s refusal within which to appeal; (b) Be conspicuously available to the consumer; (c) Be similar to the… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right against discrimination Archived excerpt — the text we read …ot subject to sale under this subparagraph does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility. (e) Discriminate against a consumer that exercises a right provided to the consumer under ORS 646A.570 to 646A.589 by means such as denying goods or services, charging different prices or rates for goods or services or providing a different level of quality or selection of goods or services to the consumer. (3) Subsections (1) and (2) of this section do not: (a) Require a controller to provide a good or service that requires personal data from a consumer that the controller does not collect or maintain; or (b) Prohibit… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Right to a list of the specific third parties data was disclosed to At the controller's option, the list may name the specific third parties (other than natural persons) that received this consumer's personal data, or those that received any personal data. Archived excerpt — the text we read …btain from a controller: (A) Confirmation as to whether the controller is processing or has processed the consumer’s personal data and the categories of personal data the controller is processing or has processed; (B) At the controller’s option, a list of specific third parties, other than natural persons, to which the controller has disclosed: (i) The consumer’s personal data; or (ii) Any personal data; and (C) A copy of all of the consumer’s personal data that the controller has processed or is processing; (b) Require a controller to correct inaccuracies in personal data about the consumer, taking into account the … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Not granted: Private right of action Archived excerpt — the text we read …y General’s claim under subsection (4) of this section. (7) The Attorney General has exclusive authority to enforce the provisions of ORS 646A.570 to 646A.589. ORS 646A.570 to 646A.589, or any other laws of this state, do not create a private right of action to enforce a violation of ORS 646A.570 to 646A.589. [2023 c.369 §9; 2023 c.369 §11; 2024 c.64 §§1,2] Note: Sections 4 to 6, chapter 417, Oregon Laws 2025, provide: Sec. 4. Section 5 of this 2025 Act is added to and made a part of ORS 646A.570 to 646A.589. [2025 c.417 … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source

Who the law governs

  • Controllers Archived excerpt — the text we read …g or choice; and (b) The consumer’s inaction does not constitute consent. (7) “Consumer” means a natural person who resides in this state and acts in any capacity other than in a commercial or employment context. (8) “Controller” means a person that, alone or jointly with another person, determines the purposes and means for processing personal data. (9) “Covered entity” has the meaning given that term in 45 C.F.R. 160.103, as in effect on January 1, 2024. (10) “Decisions that produce legal effects or effects of similar significance” means decisions that result in… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Processors Archived excerpt — the text we read …ctions or operations that is performed, automatically or otherwise, on personal data or on sets of personal data, such as collecting, using, storing, disclosing, analyzing, deleting or modifying the personal data. (15) “Processor” means a person that processes personal data on behalf of a controller. (16) “Profiling” means an automated processing of personal data for the purpose of evaluating, analyzing or predicting an identified or identifiable consumer’s economic circumstances, health, personal preferences, inte… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source

Exemptions

  • Public corporations and public bodies Archived excerpt — the text we read …ate of a motor vehicle manufacturer that controls or processes any personal data obtained from a consumer’s use of a motor vehicle or any component of a motor vehicle. (2) ORS 646A.570 to 646A.589 do not apply to: (a) A public corporation, including the Oregon Health and Science University and the Oregon State Bar, or a public body, as defined in ORS 174.109; (b) Protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, the Health… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • HIPAA protected health information Archived excerpt — the text we read …f a motor vehicle. (2) ORS 646A.570 to 646A.589 do not apply to: (a) A public corporation, including the Oregon Health and Science University and the Oregon State Bar, or a public body, as defined in ORS 174.109; (b) Protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and regulations promulgated under the Act, as in effect on January 1, 2024; (c) Information used only for public health activities and purposes described in 45 C.F.R. 164.512, as in effect on January 1, … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Public health activities information Archived excerpt — the text we read …siness associate creates for the purpose of complying with, the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and regulations promulgated under the Act, as in effect on January 1, 2024; (c) Information used only for public health activities and purposes described in 45 C.F.R. 164.512, as in effect on January 1, 2024; (d) Information that identifies a consumer in connection with: (A) Activities that are subject to the Federal Policy for the Protection of Human Subjects, codified as 45 C.F.R. part 4… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Human subjects research information Archived excerpt — the text we read …January 1, 2024; (c) Information used only for public health activities and purposes described in 45 C.F.R. 164.512, as in effect on January 1, 2024; (d) Information that identifies a consumer in connection with: (A) Activities that are subject to the Federal Policy for the Protection of Human Subjects, codified as 45 C.F.R. part 46 and in various other federal regulations, as in effect on January 1, 2024; (B) Research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonis… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Good clinical practice research Archived excerpt — the text we read …connection with: (A) Activities that are subject to the Federal Policy for the Protection of Human Subjects, codified as 45 C.F.R. part 46 and in various other federal regulations, as in effect on January 1, 2024; (B) Research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; (C) Activities that are subject to the protections provided in 21 C.F.R. parts 50 and 56, as in effect on January 1, 2024; or (D) Research conducted in acco… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • FDA human subjects protections Archived excerpt — the text we read …24; (B) Research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; (C) Activities that are subject to the protections provided in 21 C.F.R. parts 50 and 56, as in effect on January 1, 2024; or (D) Research conducted in accordance with the requirements set forth in subparagraphs (A) to (C) of this paragraph or otherwise in accordance with applicable law; (e) Patient ident… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Research conducted per applicable law Archived excerpt — the text we read … Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; (C) Activities that are subject to the protections provided in 21 C.F.R. parts 50 and 56, as in effect on January 1, 2024; or (D) Research conducted in accordance with the requirements set forth in subparagraphs (A) to (C) of this paragraph or otherwise in accordance with applicable law; (e) Patient identifying information, as defined in 42 C.F.R. 2.11, as in effect on January 1, 2024, that is collected and processed in accordance with 42 C.F.R. part 2; (f) Patient safety work product, as defined in … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Substance use disorder patient identifying information Archived excerpt — the text we read …rts 50 and 56, as in effect on January 1, 2024; or (D) Research conducted in accordance with the requirements set forth in subparagraphs (A) to (C) of this paragraph or otherwise in accordance with applicable law; (e) Patient identifying information, as defined in 42 C.F.R. 2.11, as in effect on January 1, 2024, that is collected and processed in accordance with 42 C.F.R. part 2; (f) Patient safety work product, as defined in 42 C.F.R. 3.20, as in effect on January 1, 2024, that is created for purposes of improving patient safety under 42 C.F.R. part 3; (g) Information and documents created f… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Patient safety work product Archived excerpt — the text we read …otherwise in accordance with applicable law; (e) Patient identifying information, as defined in 42 C.F.R. 2.11, as in effect on January 1, 2024, that is collected and processed in accordance with 42 C.F.R. part 2; (f) Patient safety work product, as defined in 42 C.F.R. 3.20, as in effect on January 1, 2024, that is created for purposes of improving patient safety under 42 C.F.R. part 3; (g) Information and documents created for the purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq., and implementing regulations, both as in effect on January 1, 2024; (h) Information … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Health Care Quality Improvement Act information Archived excerpt — the text we read …in accordance with 42 C.F.R. part 2; (f) Patient safety work product, as defined in 42 C.F.R. 3.20, as in effect on January 1, 2024, that is created for purposes of improving patient safety under 42 C.F.R. part 3; (g) Information and documents created for the purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq., and implementing regulations, both as in effect on January 1, 2024; (h) Information that originates from, or that is intermingled so as to be indistinguishable from, information described in paragraphs (b) to (g) of t… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Information intermingled with exempt health information in (b)-(g) Only when a HIPAA covered entity or business associate, or a 42 C.F.R. part 2 qualified service organization program, maintains it in the same manner those laws require. Archived excerpt — the text we read ….F.R. part 3; (g) Information and documents created for the purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq., and implementing regulations, both as in effect on January 1, 2024; (h) Information that originates from, or that is intermingled so as to be indistinguishable from, information described in paragraphs (b) to (g) of this subsection that a covered entity or business associate, or a program of a qualified service organization, as defined in 42 C.F.R. 2.11, as in effect on January 1, 2024, creates, collects, processes, uses or maintains in the same manner as is required under the laws, regulations and guidelines described in paragraphs (b) to (g) of this subsection; (i) Information processed or maintained solely in connection with, and for the purpose of, enabling: (A) An individual’s employment or application for employment; (B) An individual’s ownership of, or function as a d… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Employment and job-application data Information processed solely in connection with, and for the purpose of, enabling an individual's employment or application for employment. Archived excerpt — the text we read …as is required under the laws, regulations and guidelines described in paragraphs (b) to (g) of this subsection; (i) Information processed or maintained solely in connection with, and for the purpose of, enabling: (A) An individual’s employment or application for employment; (B) An individual’s ownership of, or function as a director or officer of, a business entity; (C) An individual’s contractual relationship with a business entity; (D) An individual’s receipt of benefits from an empl… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Business owner, director and officer data Information processed solely in connection with, and for the purpose of, enabling an individual's ownership of, or function as a director or officer of, a business entity. Archived excerpt — the text we read …ibed in paragraphs (b) to (g) of this subsection; (i) Information processed or maintained solely in connection with, and for the purpose of, enabling: (A) An individual’s employment or application for employment; (B) An individual’s ownership of, or function as a director or officer of, a business entity; (C) An individual’s contractual relationship with a business entity; (D) An individual’s receipt of benefits from an employer, including benefits for the individual’s dependents or beneficiaries; or (E) Notice of an… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Data for an individual contractor relationship Information processed solely in connection with, and for the purpose of, enabling an individual's contractual relationship with a business entity. Archived excerpt — the text we read …ly in connection with, and for the purpose of, enabling: (A) An individual’s employment or application for employment; (B) An individual’s ownership of, or function as a director or officer of, a business entity; (C) An individual’s contractual relationship with a business entity; (D) An individual’s receipt of benefits from an employer, including benefits for the individual’s dependents or beneficiaries; or (E) Notice of an emergency to persons that an individual specifies; (j) Any activity … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Employee benefits data Information processed solely in connection with, and for the purpose of, enabling an individual's receipt of employer benefits (incl. for dependents or beneficiaries). Archived excerpt — the text we read …idual’s employment or application for employment; (B) An individual’s ownership of, or function as a director or officer of, a business entity; (C) An individual’s contractual relationship with a business entity; (D) An individual’s receipt of benefits from an employer, including benefits for the individual’s dependents or beneficiaries; or (E) Notice of an emergency to persons that an individual specifies; (j) Any activity that involves collecting, maintaining, disclosing, selling, communicating or using information for the purpose of evaluating a c… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Emergency contact data Information processed solely in connection with, and for the purpose of, enabling notice of an emergency to persons an individual specifies. Archived excerpt — the text we read …iness entity; (C) An individual’s contractual relationship with a business entity; (D) An individual’s receipt of benefits from an employer, including benefits for the individual’s dependents or beneficiaries; or (E) Notice of an emergency to persons that an individual specifies; (j) Any activity that involves collecting, maintaining, disclosing, selling, communicating or using information for the purpose of evaluating a consumer’s creditworthiness, credit standing, credit capacity, character,… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • FCRA credit-reporting activity FCRA credit-reporting activity by consumer reporting agencies, furnishers (15 U.S.C. 1681s-2) and users of consumer reports under 15 U.S.C. 1681b(a)(3), if done strictly per FCRA. Archived excerpt — the text we read …siness entity; (D) An individual’s receipt of benefits from an employer, including benefits for the individual’s dependents or beneficiaries; or (E) Notice of an emergency to persons that an individual specifies; (j) Any activity that involves collecting, maintaining, disclosing, selling, communicating or using information for the purpose of evaluating a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living if done strictly in accordance with the provisions of the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq., as in effect on January 1, 2024, by: (A) A consumer reporting agency, as defined in 15 U.S.C. 1681a(f), as in effect on January 1, 2024; (B) A person who furnishes information to a consumer reporting agency under 15 U.S.C. 1681s-2, as in effect on Janua… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • GLBA-regulated financial data Archived excerpt — the text we read …ho uses a consumer report as provided in 15 U.S.C. 1681b(a)(3); (k) Information collected, processed, sold or disclosed under and in accordance with the following federal laws, all as in effect on January 1, 2024: (A) The Gramm-Leach-Bliley Act, P.L. 106-102, and regulations adopted to implement that Act; (B) The Driver’s Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq.; (C) The Family Educational Rights and Privacy Act, 20 U.S.C. 1232g and regulations adopted to implement that Act; and (D) The Airline Deregula… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Driver's Privacy Protection Act data Archived excerpt — the text we read …ocessed, sold or disclosed under and in accordance with the following federal laws, all as in effect on January 1, 2024: (A) The Gramm-Leach-Bliley Act, P.L. 106-102, and regulations adopted to implement that Act; (B) The Driver’s Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq.; (C) The Family Educational Rights and Privacy Act, 20 U.S.C. 1232g and regulations adopted to implement that Act; and (D) The Airline Deregulation Act, P.L. 95-504, only to the extent that an air carrier collects inf… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • FERPA-regulated education data Archived excerpt — the text we read …ral laws, all as in effect on January 1, 2024: (A) The Gramm-Leach-Bliley Act, P.L. 106-102, and regulations adopted to implement that Act; (B) The Driver’s Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq.; (C) The Family Educational Rights and Privacy Act, 20 U.S.C. 1232g and regulations adopted to implement that Act; and (D) The Airline Deregulation Act, P.L. 95-504, only to the extent that an air carrier collects information related to prices, routes or services and only to the extent that the provisions of the Airline Deregulati… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Airline Deregulation Act preempted data Archived excerpt — the text we read …o implement that Act; (B) The Driver’s Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq.; (C) The Family Educational Rights and Privacy Act, 20 U.S.C. 1232g and regulations adopted to implement that Act; and (D) The Airline Deregulation Act, P.L. 95-504, only to the extent that an air carrier collects information related to prices, routes or services and only to the extent that the provisions of the Airline Deregulation Act preempt ORS 646A.570 to 646A.589; (L) A financial institution, as defined in ORS 706.008, or a financial institution’s affiliate or subsidiary … Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Financial institutions (ORS 706.008) and financial affiliates Financial institutions as defined in ORS 706.008, and their affiliates or subsidiaries only and directly engaged in financial activities under 12 U.S.C. 1843(k) (entity-level). Archived excerpt — the text we read …95-504, only to the extent that an air carrier collects information related to prices, routes or services and only to the extent that the provisions of the Airline Deregulation Act preempt ORS 646A.570 to 646A.589; (L) A financial institution, as defined in ORS 706.008, or a financial institution’s affiliate or subsidiary that is only and directly engaged in financial activities, as described in 12 U.S.C. 1843(k), as in effect on January 1, 2024; (m) Information that originates from, or is intermingled so as to be indistinguishable from, information described in paragraph (k)(A) of this subsection and that a licensee, as defined in ORS 725.010, collects, proce… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • GLBA-intermingled information held by consumer-finance licensees (ORS 725.010) Archived excerpt — the text we read …tution, as defined in ORS 706.008, or a financial institution’s affiliate or subsidiary that is only and directly engaged in financial activities, as described in 12 U.S.C. 1843(k), as in effect on January 1, 2024; (m) Information that originates from, or is intermingled so as to be indistinguishable from, information described in paragraph (k)(A) of this subsection and that a licensee, as defined in ORS 725.010, collects, processes, uses or maintains in the same manner as is required under the laws and regulations specified in paragraph (k)(A) of this subsection; (n) An insurer, as defined in ORS 731.106, other than a person that, alone or in combination with another person, establishes and maintains a self-insurance program and that does not otherwise engage in the business o… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Insurers as defined in ORS 731.106 Not a person that only maintains a self-insurance program and does not otherwise write insurance policies. Archived excerpt — the text we read …s subsection and that a licensee, as defined in ORS 725.010, collects, processes, uses or maintains in the same manner as is required under the laws and regulations specified in paragraph (k)(A) of this subsection; (n) An insurer, as defined in ORS 731.106, other than a person that, alone or in combination with another person, establishes and maintains a self-insurance program and that does not otherwise engage in the business of entering into policies of insurance; (o) An insurance producer, as defined in ORS 731.104; (p) An insurance consultant, as defined in ORS 744.602; (q) A person that holds a third party administrator license issued under ORS 744.710; (r) A nonprofit or… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Insurance producers Archived excerpt — the text we read …, other than a person that, alone or in combination with another person, establishes and maintains a self-insurance program and that does not otherwise engage in the business of entering into policies of insurance; (o) An insurance producer, as defined in ORS 731.104; (p) An insurance consultant, as defined in ORS 744.602; (q) A person that holds a third party administrator license issued under ORS 744.710; (r) A nonprofit organization that is established to detect and prevent fr… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Insurance consultants Archived excerpt — the text we read …h another person, establishes and maintains a self-insurance program and that does not otherwise engage in the business of entering into policies of insurance; (o) An insurance producer, as defined in ORS 731.104; (p) An insurance consultant, as defined in ORS 744.602; (q) A person that holds a third party administrator license issued under ORS 744.710; (r) A nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance; and (s) Nonc… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Third party administrators Archived excerpt — the text we read …nce program and that does not otherwise engage in the business of entering into policies of insurance; (o) An insurance producer, as defined in ORS 731.104; (p) An insurance consultant, as defined in ORS 744.602; (q) A person that holds a third party administrator license issued under ORS 744.710; (r) A nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance; and (s) Noncommercial activity of: (A) A publisher, editor, reporter or other person who is connec… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Insurance fraud nonprofit organizations Archived excerpt — the text we read …s of insurance; (o) An insurance producer, as defined in ORS 731.104; (p) An insurance consultant, as defined in ORS 744.602; (q) A person that holds a third party administrator license issued under ORS 744.710; (r) A nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance; and (s) Noncommercial activity of: (A) A publisher, editor, reporter or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet, report or other publication in genera… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Noncommercial activity of news publishers, editors and reporters (646A.572(2)(s)(A)) Archived excerpt — the text we read … third party administrator license issued under ORS 744.710; (r) A nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance; and (s) Noncommercial activity of: (A) A publisher, editor, reporter or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet, report or other publication in general circulation; (B) A radio or television station that holds a license issued by the Federal Communications Commission; (C) A nonprofit organization that provides programming to radio or television networks; or (D) An entity that p… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Noncommercial activity of FCC-licensed radio or television stations (646A.572(2)(s)(B)) Archived excerpt — the text we read …cial activity of: (A) A publisher, editor, reporter or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet, report or other publication in general circulation; (B) A radio or television station that holds a license issued by the Federal Communications Commission; (C) A nonprofit organization that provides programming to radio or television networks; or (D) An entity that provides an information service, including a press association or wire service. (3) ORS 646A.570 to 646A.… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Noncommercial activity of nonprofit programming providers to radio or television networks 646A.572(2)(s)(C). Archived excerpt — the text we read … a newspaper, magazine, periodical, newsletter, pamphlet, report or other publication in general circulation; (B) A radio or television station that holds a license issued by the Federal Communications Commission; (C) A nonprofit organization that provides programming to radio or television networks; or (D) An entity that provides an information service, including a press association or wire service. (3) ORS 646A.570 to 646A.589 do not prohibit a controller or processor from: (a) Complying with federal, state or… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Noncommercial activity of information services Including press associations and wire services. 646A.572(2)(s)(D). Archived excerpt — the text we read …eral circulation; (B) A radio or television station that holds a license issued by the Federal Communications Commission; (C) A nonprofit organization that provides programming to radio or television networks; or (D) An entity that provides an information service, including a press association or wire service. (3) ORS 646A.570 to 646A.589 do not prohibit a controller or processor from: (a) Complying with federal, state or local statutes, ordinances, rules or regulations; (b) Complying with a federal, state or local govern… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Evidentiary privilege (compliance would violate an Oregon evidentiary privilege) Archived excerpt — the text we read …he purpose of performing a contract to which the consumer is a party; or (m) Assisting another controller or processor with any of the activities set forth in this subsection. (4) ORS 646A.570 to 646A.589 do not apply to the extent that a controller’s or processor’s compliance with ORS 646A.570 to 646A.589 would violate an evidentiary privilege under the laws of this state. Notwithstanding the provisions of ORS 646A.570 to 646A.589, a controller or processor may provide personal data about a consumer in a privileged communication to a person that is covered by an evidentiary privilege und… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source
  • Privileged communications to a person covered by an evidentiary privilege Archived excerpt — the text we read … this subsection. (4) ORS 646A.570 to 646A.589 do not apply to the extent that a controller’s or processor’s compliance with ORS 646A.570 to 646A.589 would violate an evidentiary privilege under the laws of this state. Notwithstanding the provisions of ORS 646A.570 to 646A.589, a controller or processor may provide personal data about a consumer in a privileged communication to a person that is covered by an evidentiary privilege under the laws of this state. (5) A controller may process personal data in accordance with subsection (3) of this section only to the extent that the processing is adequate and reasonably necessary for, relevant to, proportionate in relation to an… Archived from source — captured 2026-07-20 · snapshot 698044fa Verify at the source

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source.

Timeline

OCPA milestones

Drag the handle or use ← → to step through the milestones. The marker shows where today falls.

Done Upcoming Today
You are here
Completed July 1, 2025

Act applies to 501(c)(3) nonprofit organizations

Applies to organizations described in section 501(c)(3) of the Internal Revenue Code.

Source: primary citation

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source. Reference only, not legal advice.

Status Signed Status — Privacy-law tracker Maximum penalty per violation — Regulator guidance Private right of action — Privacy-law tracker
When staying on top of the law isn't enough, DataGrail automates the work.
DSR automation and regulatory tracking — handled by the platform behind this reference.
How DataGrail helps
Back to the Regulations Hub Reference only — not legal advice. Published Sep 29, 2026