What is the data breach notification deadline in Oregon?

Oregon requires notice to affected individuals 45 calendar days from discovery (Or. Rev. Stat. §§646A.600–628).

Do you have to notify the Oregon Attorney General of a data breach?

Yes. Oregon Attorney General must be notified.

← All jurisdictions

OR · data breach notification

Oregon

med

Or. Rev. Stat. §§646A.600–628

Individual deadline

45 days

Trigger standard

Risk of harm

AG / regulator

Required

Notice to individuals	45 calendar days from discovery
Risk-of-harm standard	no notice if, after investigation/law-enforcement consultation, no reasonable likelihood of harm
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	Oregon Attorney General, required at 250+ residents; within 45 days Written or electronic notice; copy of consumer notice
Credit reporting agencies	No CRA-notice requirement.
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	No, enforcement by the state.
Notable PI definitions	Includes biometric, credentials, medical, health insurance.

Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Oregon breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →