---
title: "Oregon privacy law (OCPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/oregon/processors"
source: "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Oregon Consumer Privacy Act

# Oregon privacy law (OCPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Processors must follow instructions, help with consumer requests and assessments, and adopt reasonable safeguards. The contract must be binding and set out instructions, nature and purpose, data types and duration, and the parties' rights and obligations. It must require confidentiality, deletion or return, compliance information, subcontracts that flow down obligations, and assessments by the controller or an independent assessor.

## Key points

1. Processor duties: follow instructions, assist with consumer requests, adopt security safeguards, give information for assessments.

   Section: [ORS 646A.581(1)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

2. Contract must be binding and state instructions, nature, purpose, data types, duration, rights and obligations.

   Section: [ORS 646A.581(2)(a) to (c)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

3. Contract must require confidentiality, deletion or return, and information to verify compliance.

   Section: [ORS 646A.581(2)(d) to (f)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

4. Subcontractors bound by a subcontract with the same obligations.

   Section: [ORS 646A.581(2)(g)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

5. Assessments by the controller, its designee or an independent assessor, with results reported on request.

   Section: [ORS 646A.581(2)(h)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

6. A person not bound by, or not following, instructions, or that starts setting purposes and means, is a controller.

   Section: [ORS 646A.581(4)](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

## Sources

- [ORS chapter 646A (2025 edition), ORS 646A.570 to 646A.589 with notes](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Oregon statute](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html)

Reference material, not legal advice.

## Other topics for Oregon

- [Applicability](https://dposchool.com/state-privacy-laws/state/oregon/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/oregon/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/oregon/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/oregon/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Oregon](https://dposchool.com/state-privacy-laws/state/oregon) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/oregon/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/oregon/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents