Data breach notification
Oregon's Consumer Information Protection Act runs from ORS 646A.600 to 646A.628, with the notice duty at 646A.604.
Its timing rule, its definition and its exception each have a feature worth reading closely.
A covered entity shall give notice of a breach of security in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security.
The Attorney General must also receive notice, in writing or electronically, if the number of consumers to whom the covered entity must send notice exceeds 250. Below that number, the text we checked shows consumer notice only.
Oregon pairs a name with listed elements if encryption, redaction or other methods have not rendered the elements unusable, or if the elements are encrypted and the encryption key has been acquired.
| Category | Covered element |
|---|---|
| Government numbers | Social Security number; driver's license or state ID; passport or other US-issued ID number. |
| Money | Financial account or card number with any required code or password. |
| Biometrics | Data such as an image of a fingerprint, retina or iris used to authenticate the consumer. |
| Health | Health insurance policy or subscriber ID with another identifier; medical history or condition information. |
| Online accounts | A username or other account identifier with the means to authenticate it. |
Any of those elements also count without a name, if they would enable identity theft.
Consumer notice is not needed if the covered entity reasonably determines that the consumers whose personal information was subject to the breach are unlikely to suffer harm. The text we checked ties that to an investigation or consultation with law enforcement, and the determination must be documented in writing and kept for five years.
Any write-up of an incident is only as good as the facts behind it.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
The watermark setting lives at room level and is on by default. Recipients confirm their email with a six-digit code and need no account, and groups see only the folders assigned to them. The log is chained and exports as CSV, ready to sit beside an Oregon business's own notes about files kept in ShareAndGo.
Checked against Oregon's published law on November 2, 2026. This is general information, not legal advice.
