Oregon Consumer Information Protection Act: breach notification

Requires any business or other entity holding Oregon residents' personal information to notify affected consumers of a data breach within 45 days, and the Attorney General when more than 250 Oregonians are affected. Vendors must alert the covered entity within 10 days. Notice may be skipped only after a documented determination that harm is unlikely.