Chipping Away at Privacy Compliance: New Developments in Oregon

Oregon’s privacy compliance regime has entered a new phase. With the Oregon Consumer Privacy Act (OCPA) now fully in effect, new consumer rights and opt-out requirements in place, and the Attorney General actively enforcing the law without a statutory cure period, businesses should take a fresh look at their privacy programs and compliance processes.

Oregon’s privacy framework now extends well beyond breach notification and security obligations. The OCPA, together with Oregon’s breach notification law and data broker registration requirements, imposes obligations across the data lifecycle, including transparency, consumer rights, sensitive-data processing, vendor management, data protection assessments, and incident response. At the same time, regulators are increasingly scrutinizing practical compliance issues such as privacy notices, consumer request workflows, and documentation supporting privacy practices.

As enforcement activity matures and privacy regulators continue to coordinate across jurisdictions, organizations should assess whether their policies, procedures, contracts, and technical controls align with Oregon’s evolving requirements. Businesses that have not recently reviewed their privacy compliance programs may want to take this opportunity to identify potential gaps before they become the subject of regulatory scrutiny.