What Is the Oregon Consumer Privacy Act (OCPA)? What Businesses Need to Know

**Executive Summary:** The Oregon Consumer Privacy Act (OCPA), effective July 1, 2024 (with nonprofit applicability from July 2025), creates broad consumer privacy rights and strict obligations for organizations that control or process Oregon residents' personal data; it prescribes rights such as access, correction, deletion, portability, and opt-outs, requires transparency, data minimization, purpose limitation, data protection assessments, processor contracts, and security controls, and exposes noncompliant entities to enforcement by the Oregon Attorney General (including penalties up to $7,500 per violation); the document provides practical preparation steps (data mapping, updated privacy notices, risk assessments, vendor oversight, and technical controls) and links compliance to improved cybersecurity posture.