What Nonprofits Need to Know About Oregon Data Privacy Laws

As Oregon data privacy laws evolve, nonprofit organizations must prepare to meet new compliance requirements under the Oregon Consumer Privacy Act (OCPA). According to an article by the Tonkon Torp firm, beginning July 1, 2025, the OCPA will apply to nonprofits that do business in Oregon or offer products or services to Oregon residents. The law grants consumers significant rights over their personal data, and the grace period for nonprofits is set to expire. To avoid civil penalties and reputational harm, organizations must take proactive steps to comply before enforcement begins.

Under the OCPA, Oregon consumers have the right to access, correct, delete, and obtain a portable copy of their personal data. They can also opt out of targeted advertising and the sale of their personal information. These rights apply to nonprofits that control or process data from 100,000 or more consumers annually (excluding payment transaction data) or 25,000 or more consumers if more than 25% of their revenue is derived from selling personal data. For qualifying organizations, compliance will be mandatory by July 2025.

In preparation, the article suggests nonprofits should thoroughly review their data collection practices to understand what data is collected and why. They must update privacy policies to reflect consumer rights under the OCPA, develop clear procedures for responding to consumer data requests, and implement robust security measures to protect personal information.

Compliance with state privacy rules, including Oregon data privacy laws, is no longer optional. Nonprofits must assess and adjust their data practices now to reduce legal exposure and maintain trust with stakeholders in an increasingly privacy-conscious environment.