Oregon Consumer Privacy Act (OCPA) Assessment

The source assessment explains that OCPA applies to organizations that conduct business in Oregon or provide products or services to Oregon residents, and that also meet one of the statute’s applicability thresholds or special criteria such as certain motor vehicle data processing.

The source assessment lists exempt entities and exempt categories of data, including certain public bodies, financial institutions, specified publishers and broadcasters, medical and research data, FCRA data, GLBA data, FERPA data, employment-related data, and other listed exemptions.

The source assessment explains that OCPA does not prohibit processing for certain purposes such as legal compliance, governmental inquiries, law enforcement cooperation, legal claims, requested products or services, protecting health and safety, internal operations, contractual obligations, and system security. It also emphasizes that the organization bears the burden of demonstrating that processing is not prohibited.

The source assessment recommends documenting what data is collected, how it is collected and used, where it is stored, how it flows through systems and vendors, who has access, and what safeguards protect it.

The source assessment recommends automated classification and categorization as a best practice to support compliance, security, and data handling.

The source assessment lists these rights and expects organizations to establish methods for submitting requests that account for normal interactions, security, and identity verification. It also highlights opt-out mechanisms, including webpage links and universal opt-out signals.

The source assessment discusses 45-day response timelines, extensions, refusal notices, appeals, authentication rules, special handling for opt-outs, parental or guardian requests for children, and authorized agents for opt-out requests.

The source assessment says valid consent must be affirmative, freely given, specific, informed, and unambiguous, without dark-pattern-like interference or reliance on inaction. It also highlights consent for sensitive data, children’s data, some teen sale scenarios, and revocation that must be honored within 15 days.

The source assessment expects the privacy notice to cover categories of personal data, purposes, rights, categories of third parties, contact methods, organization identity, targeted advertising or profiling disclosures where applicable, and how consumers can submit rights requests.

The source assessment discusses governance mechanisms, assigned responsibility, employee training, complaint handling, transparency, non-discrimination, data minimization, purpose specification, and restrictions on certain children’s-data and geolocation-related practices.

The source assessment emphasizes security measures appropriate to the volume and nature of personal data, risk-based controls, access controls, physical security, communications security, and required commitments and oversight where de-identified data is used or disclosed.

The source assessment expects documented data protection assessments for targeted advertising, sensitive data, sale of personal data, and certain high-risk profiling activities, and notes retention for at least five years. It also mentions the option to use a single assessment for similar processing or reasonably similar assessments conducted under other laws.

The source assessment recommends mechanisms to detect breaches across all data stores, documented response procedures, breach assessments, notification capability, and breach recordkeeping sufficient to support review by authorities.

The source assessment expects processors to assist with rights requests, security, and assessments, and says organizations should formally review vendor compliance, verify contractual privacy controls, and use binding agreements that define instructions, purpose, duration, data type, and rights and obligations.

The source assessment repeatedly emphasizes that OCPA readiness depends not only on written policies, but also on operational capability, documentation, and the ability to respond to consumers and regulators.