Oregon OCPA

Oregon Consumer Privacy Act - consumer rights, controller duties, opt-out signals.


Short name	OR OCPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers OR OCPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for OR OCPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for OR OCPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`OR-OCPA-SEC` Data Security Safeguards	Controllers must establish, implement and maintain safeguards that protect the confidentiality, integrity and accessibility of personal data, appropriate to its volume and nature; integrity-verifiable processing software supports this duty (ORS 646A.570 et seq., controller data-security duty)	Scan
`OR-OCPA-MIN` Minimisation Accountability	Collection must be limited to what is adequate, relevant and reasonably necessary for the specified purposes; that limitation presumes an inventory of the software systems through which consumer data flows (ORS 646A.570 et seq., controller duties)	Scan
`OR-OCPA-THIRDPARTY` Third-Party Disclosure Traceability	Oregon uniquely lets a consumer demand a list of the specific third parties to which the controller disclosed personal data; producing that list requires the third-party/vendor chain, including software suppliers, to be recorded (ORS 646A.570 et seq., consumer right to third-party list)	Scan
`OR-OCPA-DPIA` Data Protection Assessment Readiness	Controllers must conduct and retain data protection assessments for heightened-risk processing such as targeted advertising, sale, profiling and sensitive data; assessments depend on recorded versions of the processing software (ORS 646A.570 et seq., data protection assessments)	Scan
`OR-OCPA-RIGHTS` Consumer Rights and Opt-Out Signals	Consumers hold access, correction, deletion, portability and opt-out rights, and controllers must honor opt-out preference signals; executing these across systems requires unambiguous component identification (ORS 646A.570 et seq., consumer rights and opt-out provisions)	Scan
`OR-OCPA-DEPS` Data Flow Mapping	Because disclosure obligations reach specific downstream recipients, controllers should be able to map how data-processing components relate to one another; a documented dependency graph evidences that flow mapping (ORS 646A.570 et seq., disclosure and transparency provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ORS-646A.574`	Consumer Rights: Access, Correction, Deletion & Portability
`ORS-646A.574(1)(e)`	Opt-Out of Sale, Targeted Ads & Profiling
`ORS-646A.576`	Sensitive Data: Opt-In Consent
`ORS-646A.578`	Data Protection Assessment
`ORS-646A.579`	Processor Contracts
`ORS-646A.573`	Privacy Notice
`ORS-646A.575`	Appeals & Non-Discrimination
`ORS-646A.577`	Children's Data Protection

Policy templates

Written for OR OCPA:

Oregon OCPA State Privacy Notice
Oregon OCPA Data Protection Assessment Procedure
Oregon OCPA Consumer Rights Request Handling Procedure

And 22 from the standard set, adapted to OR OCPA.