# Oregon — US state data breach notification deadlines by state

For Oregon, statute citation is ORS 646A.604; individual notice deadline is in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security; individual notice hard deadline (days) is 45; ag / regulator notice deadline is either in writing or electronically; ag notice resident-count trigger is exceeds 250, recorded from its source on 2026-08-18.

- **State:** Oregon _(verified: appears in the quote below)_
- **Statute citation:** ORS 646A.604
- **Individual notice deadline:** in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security
- **Individual notice hard deadline (days):** 45 _(our reading, not quoted from the source)_
- **AG / regulator notice deadline:** either in writing or electronically
- **AG notice resident-count trigger:** exceeds 250
- **Consumer reporting agency notice trigger (residents):** more than 1,000 consumers
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** The AG threshold applies to consumers to whom the covered entity must send individual notice (i.e., 250+ affected consumers). The CRA notice (at 1,000+) must be given without unreasonable delay and must not delay individual consumer notification. Vendors have a separate 10-day deadline to notify covered entities of a breach. _(our reading, not quoted from the source)_

## What the source says

> ����� (a) A public corporation, including the Oregon Health and Science University and the Oregon State Bar, or a public body, as defined in ORS 174.109; ����� (b) Protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and regulations promulgated under the Act, as in effect on January 1, 2024; ����� (c) Information used only for public health activities and purposes described in 45 C.F.R.

## Source

- https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).