Conduct data protection assessments + apply privacy by design + maintain security practices per Oregon OCPA per ORS 646A.580. Data Protection Assessments (DPAs) per ORS 646A.580 are required for processing activities that present a heightened risk of harm including (a) sale of personal data, (b) targeted advertising, (c) profiling producing legal or similarly significant effects, (d) processing sensitive data, (e) processing for purposes other than the purpose for which the data was collected (further processing). DPAs must (a) identify + weigh benefits flowing to controller + consumer + other interested parties + the public + (b) consider risks to the rights of consumers + (c) document mitigations + (d) be available to Attorney General on request. Privacy by design and default per general OCPA obligations must (a) embed privacy considerations in system design + procurement + change management + (b) maintain privacy-preserving defaults + (c) maintain data minimisation by design. Reasonable Data Security Practices per ORS 646A.578 must (a) establish + implement + maintain reasonable administrative + technical + physical data security practices appropriate to volume + nature + complexity of activities, (b) align with applicable security frameworks (NIST CSF + ISO 27001 + state breach notification preceded security standards).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.