How long does a company have to notify me of a data breach in Oregon?

Under Oregon law, companies must notify affected residents within 45 days of discovering a breach. Failure to notify within this window is itself a violation of state law.

Oregon Attorney General Database

Oregon Data Breach Lawsuits

Q: What is the Oregon data breach notification law?

Oregon data breaches are governed by the Oregon Consumer Identity Theft Protection Act (ORS § 646A.600 et seq.). Oregon requires notification within 45 days and has one of the broadest definitions of personal information in the country — including usernames and passwords, email addresses with security questions and answers, and unique biometric data. Oregon courts have been active in recognizing class action standing for breach victims.

We are tracking 50+ active data breach cases reported to the Oregon Attorney General. If your information was exposed, you may qualify for compensation — at no cost to you.

50+

Active Cases

45 days

Notification Deadline

Upfront Cost to You

Oregon Data Breach Law

Oregon Consumer Identity Theft Protection Act (ORS § 646A.600 et seq.)

Oregon requires notification within 45 days and has one of the broadest definitions of personal information in the country — including usernames and passwords, email addresses with security questions and answers, and unique biometric data. Oregon courts have been active in recognizing class action standing for breach victims.

Notification Window

45 days

Available Damages

Civil penalties up to $1,000 per violation (up to $500,000 total); AG enforcement

Are You Eligible to File a Claim?

Oregon's broad definition of personal information means a breach of your login credentials or security questions triggers full legal protections — not just financial data. Oregon courts actively support class action lawsuits.

You received a data breach notification letter

Your personal information was exposed without your consent

You are a Oregon resident or your data was held by a Oregon company

You do not need to prove financial loss to qualify