Oregon OCPA

United States

15 domains

31 controls

Oregon Consumer Privacy Act (Or. Rev. Stat. § 646A.570 et seq., effective 1 Jul 2024).

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (15)

Accountability

2 controls

Controls in the Accountability domain of Oregon OCPA — 2 controls
Code	Title	Description
OR-OCPA-578-DPA	Data Protection Assessments (DPAs)	Controllers must conduct and document a data protection assessment for processing presenting a heightened risk of harm,...
OR-OCPA-578-RECORDKEEPING	Recordkeeping for Compliance Demonstration	Controllers should maintain records sufficient to demonstrate compliance, including consent capture, DSAR fulfillment, D...

Advertising

1 controls

Controls in the Advertising domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-578-CROSS-CONTEXT	Targeted Advertising Restrictions	Targeted advertising means displaying advertisements to a consumer where the advertisement is selected based on personal...

Consent

1 controls

Controls in the Consent domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-580-CONSENT-DEFINITION	Definition of Consent	Consent must be a clear affirmative act signifying a freely given, specific, informed, and unambiguous agreement. Accept...

Consumer rights

12 controls

Controls in the Consumer rights domain of Oregon OCPA — 12 controls
Code	Title	Description
OR-OCPA-574-CORRECTION	Right to Correction	Consumers may correct inaccurate personal data, taking into account the nature of the data and purposes of processing.
OR-OCPA-574-DELETION	Right to Deletion	Consumers may request deletion of personal data, including data the controller obtained from third parties (broader than...
OR-OCPA-574-OPTOUT	Right to Opt Out of Targeted Advertising, Sale, and Profiling	Consumers may opt out of (i) targeted advertising, (ii) sale of personal data, and (iii) profiling in furtherance of dec...
OR-OCPA-574-PORTABILITY	Right to Data Portability	Consumers may obtain a portable, readily usable copy of personal data they previously provided to the controller, in a f...
OR-OCPA-574-RIGHT-THIRDPARTY-LIST	Right to List of Specific Third Parties (Distinctive Provision)	Distinct from other US state laws, OCPA grants consumers the right to obtain a list of specific third parties (not merel...
OR-OCPA-574-UOOM	Universal Opt-Out Mechanism (UOOM) Recognition	Effective 2026-07-01, controllers must recognize an opt-out preference signal sent through a universal opt-out mechanism...
OR-OCPA-577-RIGHT-ACCESS	Right to Know and Confirm Processing	Consumers have the right to confirm whether a controller is processing their personal data and to access categories of p...
OR-OCPA-578-APPEAL	Right to Appeal Denial of Request	Controllers must establish an internal process by which a consumer may appeal a refusal to take action on a request. App...
OR-OCPA-578-FREE-AUTHENTICATION	Free Response and Authentication	Controllers must provide information free of charge up to twice annually per consumer. Controllers may decline to act on...
OR-OCPA-578-LOYALTY	Bona Fide Loyalty Programs	Differential pricing or service tied to a voluntary loyalty, rewards, premium features, or club card program is permitte...
OR-OCPA-578-NON-DISCRIMINATION	Non-Discrimination for Exercising Rights	Controllers may not discriminate against consumers for exercising rights, including by denying goods or services, chargi...
OR-OCPA-578-RESPONSE-TIME	Response Timing for Consumer Requests	Controllers must respond to a consumer request without undue delay and not later than 45 days after receipt. The period...

Data classification

1 controls

Controls in the Data classification domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-578-DEIDENTIFIED	Deidentified and Pseudonymous Data	A controller in possession of deidentified data must take reasonable measures to ensure it cannot be associated with a c...

Definitions

1 controls

Controls in the Definitions domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-570-DEFINITIONS	Key Definitions: Controller, Processor, Consumer, Personal Data	Controller means a person who determines purposes and means of processing personal data. Processor means a person that p...

Enforcement

2 controls

Controls in the Enforcement domain of Oregon OCPA — 2 controls
Code	Title	Description
OR-OCPA-583-CURE	30-Day Right to Cure (Sunsets 2026-01-01)	Prior to initiating an enforcement action, the Attorney General must provide notice and a 30-day opportunity to cure all...
OR-OCPA-583-ENFORCEMENT	Enforcement by Oregon Attorney General	The Oregon Attorney General has exclusive enforcement authority. Violations are an unlawful practice under the Unlawful...

Principles

1 controls

Controls in the Principles domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-578-DATA-MIN	Data Minimization and Purpose Limitation	Controllers must limit collection of personal data to what is adequate, relevant, and reasonably necessary in relation t...

Processor management

1 controls

Controls in the Processor management domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-578-PROCESSOR-CONTRACTS	Processor Contract Requirements	Controllers must bind processors by contract setting out processing instructions, nature and purpose, type of data, dura...

Profiling

1 controls

Controls in the Profiling domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-578-PROFILING-DECISIONS	Profiling in Furtherance of Significant Decisions	Consumers have the right to opt out of profiling in furtherance of decisions that produce legal effects or effects of si...

Sale

1 controls

Controls in the Sale domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-578-SALE	Sale of Personal Data Definition	Sale means the exchange of personal data for monetary or other valuable consideration by the controller to a third party...

Scope

3 controls

Controls in the Scope domain of Oregon OCPA — 3 controls
Code	Title	Description
OR-OCPA-570-APPLICABILITY	Applicability Thresholds	OCPA applies to persons conducting business in Oregon or producing products or services targeted to Oregon residents tha...
OR-OCPA-570-EXEMPTIONS	Entity and Data Level Exemptions	OCPA provides entity-level exemptions for financial institutions and affiliates subject to GLBA, public corporations, in...
OR-OCPA-NONPROFIT-DELAY	Nonprofit Effective Date (Distinctive)	Unlike most other US state consumer privacy laws, OCPA applies to nonprofits. The effective date for nonprofits is delay...

Security

1 controls

Controls in the Security domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-578-SECURITY	Reasonable Data Security	Controllers must establish, implement, and maintain reasonable administrative, technical, and physical data security pra...

Sensitive data

2 controls

Controls in the Sensitive data domain of Oregon OCPA — 2 controls
Code	Title	Description
OR-OCPA-578-CHILD-DATA	Children's Personal Data	For consumers known to be a child (under 13), controllers must process personal data in accordance with COPPA. For consu...
OR-OCPA-578-SENSITIVE-DATA	Sensitive Data Opt-In Consent	Processing of sensitive data requires the consumer's prior opt-in consent. Sensitive data includes racial or ethnic back...

Transparency

1 controls

Controls in the Transparency domain of Oregon OCPA — 1 controls
Code	Title	Description
OR-OCPA-578-PRIVACY-NOTICE	Privacy Notice Content Requirements	Controllers must provide a reasonably accessible, clear, and meaningful privacy notice including categories of personal...

Frequently Asked Questions

What is Oregon OCPA?

Oregon OCPA is a compliance framework from United States with 15 domains and 31 controls. Oregon Consumer Privacy Act (Or. Rev. Stat. § 646A.570 et seq., effective 1 Jul 2024). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Oregon OCPA have?

Oregon OCPA has 31 controls organised across 15 domains. The largest domains are Consumer rights (12 controls), Scope (3 controls), Accountability (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Oregon OCPA map to?

Oregon OCPA does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with Oregon OCPA compliance?

Start your Oregon OCPA compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Oregon OCPA requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 31 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.

Get Started Free →

Free forever — no credit card required