When client data is breached: what Oregon's notice law says, and Washington's

Informational only, not legal advice. TacticalMS is not a law firm. Read more.

The Oregon Consumer Information Protection Act, ORS 646A.600 to 646A.628, requires a business that suffers a breach of security to notify affected consumers no later than 45 days after discovering it ^{1, 2}. ORS 646A.604 also requires notice to the Oregon Attorney General when more than 250 consumers must be notified ¹. The Oregon State Bar Professional Liability Fund (PLF) says the Act "applies to lawyers who store certain types of personal client information" ³.

This post follows yesterday's brief on CrowdStrike's 2026 report on attacks against law firms and explains what the statutes say ¹. The statute text below is quoted from the 2025 edition of the Oregon Revised Statutes on the Oregon Legislature's site, which notes that some sections of ORS chapter 646A were amended or repealed in the 2026 regular session ¹. The page links to the 2026 tables that show those changes ¹.

Who the Oregon law covers and what counts as personal information

ORS 646A.602(5) defines a "covered entity" as a person that "owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses personal information" ¹. ORS 646A.602(19) defines a "vendor" as a person a covered entity contracts with to "maintain, store, manage, process or otherwise access personal information" ¹.

Under ORS 646A.602(12), "personal information" means a consumer's first name or first initial and last name combined with one or more listed data elements ¹. The listed elements include:

• a Social Security number ¹;
• a driver license or state identification card number ¹;
• a passport or other U.S. identification number ¹;
• a financial account, credit card or debit card number together with any required access code ¹;
• biometric data used to authenticate a consumer ¹;
• a health insurance policy or subscriber number with another identifier, or information about medical history or a medical condition ¹.

The definition also covers a user name or other login identifier combined with the means to authenticate it, and some data elements without a name if they would enable identity theft ¹.

ORS 646A.602(1) defines a "breach of security" as "unauthorized acquisition of computerized data that materially compromises the security" of personal information ¹. The definition excludes an inadvertent acquisition by a person's employee or agent if the information is not misused ¹.

What ORS 646A.604 requires after a breach

• Consumers: 45 days. Notice must be given "in the most expeditious manner possible, without unreasonable delay, but not later than 45 days" after discovery ¹.
• Attorney General: more than 250 consumers. Notice to the Attorney General is required when more than 250 consumers must be notified, and ORS 646A.604(10) requires a copy of the consumer notice ¹.
• Consumer reporting agencies: more than 1,000 consumers. ORS 646A.604(6) requires notice to the nationwide consumer reporting agencies "without unreasonable delay" ¹.
• Vendors: 10 days. ORS 646A.604(2)(a) requires a vendor to notify the covered entity "as soon as is practicable but not later than 10 days" after discovering a breach ¹.

ORS 646A.604(5) lists what a consumer notice must contain, including a general description of the breach, its approximate date, the type of personal information involved, contact information, and advice to report suspected identity theft to law enforcement, including the Attorney General and the Federal Trade Commission ¹.

The statute has two exceptions worth knowing about. Under ORS 646A.604(3)(c), notice can be delayed only if a law enforcement agency determines that notice "will impede a criminal investigation" and asks in writing ¹. Under ORS 646A.604(8), no consumer notice is required if, after an appropriate investigation or consultation with law enforcement, the covered entity reasonably determines that consumers are "unlikely to suffer harm," and that determination must be documented in writing and kept for at least five years ¹.

How to report a breach to the Oregon Department of Justice

The Oregon Department of Justice's data breach page says that if a breach affects more than 250 Oregon consumers, the business must send a report and a sample of its breach notice to the DOJ ². The page says businesses can use its online "Submit Data Breach Notice" form or email databreach@doj.oregon.gov ². The DOJ also publishes a searchable database of the breach notices it has received ².

What ORS 646A.622 says about safeguards

ORS 646A.622(1) requires a covered entity or vendor to "develop, implement and maintain reasonable safeguards" for personal information, including during disposal ¹. The statute lists examples of what a security program can include ¹:

• Administrative: designating one or more employees to coordinate the program, identifying foreseeable risks, training employees "with reasonable regularity," and selecting service providers that can maintain safeguards and are bound by contract to do so ¹.
• Technical: assessing risks in network and software design, and "applying security updates and a reasonable security patch management program" ¹.
• Physical: disposing of records by "burning, pulverizing, shredding or modifying a physical record," and erasing electronic media so the information cannot be read or reconstructed ¹.

ORS 646A.622(5) says the owner of a small business, as defined in ORS 285B.123(2), complies if its safeguards fit the business's size and complexity, its activities, and the sensitivity of the information it collects ¹. ORS 646A.622(2) also treats compliance with certain federal rules, including those under the Gramm-Leach-Bliley Act and HIPAA, as compliance for information those laws cover ¹. Because the statute's list includes contracting with capable service providers ¹, our earlier list of questions Oregon firms can ask an AI vendor may be useful background on the vendor side.

What the PLF practice aid says for lawyers

The PLF practice aid "What To Do After a Data Breach," revised in August 2023, lists 19 steps ³. It calls the law by its older name, the Oregon Consumer Identity Theft Protection Act, and says it "requires notices to be sent to clients in the event of a breach" ³. The aid separately says lawyers must inform clients whose confidential information has been compromised, and points questions about ethical duties to Oregon State Bar General Counsel ³.

On insurance, the PLF says data breach claims are excluded from its Primary Coverage Plan but covered under PLF Excess Coverage, which automatically includes a Cyber Liability and Breach Response Endorsement ³.

Washington's law, for firms with Vancouver clients

Washington's RCW 19.255.010 sets different numbers ⁴. Notice to affected Washington residents is due "no more than thirty calendar days after the breach was discovered," with extensions for a law enforcement request or to determine the breach's scope ⁴. A business notifying more than 500 Washington residents must notify the Washington Attorney General within 30 days of discovery ⁴. Notice is not required when a breach is "not reasonably likely to subject consumers to a risk of harm" ⁴.

What this post does not settle

The statutes do not answer whether a particular incident is a "breach of security," which state's law applies to a given client, or how the notice rules fit with a lawyer's ethical duties ^{1, 3, 4}. Those questions depend on the facts and are for a licensed Oregon attorney or Oregon State Bar General Counsel ³.

Not legal advice. This post is general information about law and technology, not legal advice. It does not create an attorney-client relationship, and TacticalMS is not a law firm. Laws, rules and ethics opinions change; check the cited sources and talk with a licensed Oregon attorney about any specific situation. Researched and drafted with AI tools from the sources above and checked against our editorial standards. Spot an error? Email intake@tacticalms.dev and we'll fix it.