Oregon
For Oregon, statute citation is ORS 646A.604; individual notice deadline is in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security; individual notice hard deadline (days) is 45; ag / regulator notice deadline is either in writing or electronically; ag notice resident-count trigger is exceeds 250, recorded from its source on 2026-08-18.
- State
- Oregon verified
- Statute citation
- ORS 646A.604
- Individual notice deadline
- in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security
- Individual notice hard deadline (days)
- 45 our reading
- AG / regulator notice deadline
- either in writing or electronically
- AG notice resident-count trigger
- exceeds 250
- Consumer reporting agency notice trigger (residents)
- more than 1,000 consumers
- Encryption safe harbor
- yes our reading
- Notes
- The AG threshold applies to consumers to whom the covered entity must send individual notice (i.e., 250+ affected consumers). The CRA notice (at 1,000+) must be given without unreasonable delay and must not delay individual consumer notification. Vendors have a separate 10-day deadline to notify covered entities of a breach. our reading
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
����� (a) A public corporation, including the Oregon Health and Science University and the Oregon State Bar, or a public body, as defined in ORS 174.109; ����� (b) Protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and regulations promulgated under the Act, as in effect on January 1, 2024; ����� (c) Information used only for public health activities and purposes described in 45 C.F.R.
— oregonlegislature.gov, retrieved 2026-08-18
Source
- oregonlegislature.govhttps://www.oregonlegislature.gov/bills_laws/ors/ors646a.html