What a Oregon business has to have in writing

Send written notice to affected Oregon consumers within 45 days of discovering a breach, and when more than 250 Oregonians are involved file a report plus a sample copy of the consumer notice with the Department of Justice in the same window. Vendors that hold data for someone else must tell the owner of the data promptly.

Keep an information security program with administrative, technical and physical safeguards - risk assessment, access controls, staff training, secure disposal, vendor oversight and periodic testing - or follow a listed compliance path such as Gramm-Leach-Bliley or HIPAA. The statute expects the program to be written and sized to the business.

Publish a privacy notice listing the categories of personal data collected and shared, the purposes, the third parties involved and how to exercise rights; get opt-in consent before processing sensitive data; document a data protection assessment for targeted advertising, data sales, profiling and sensitive-data processing; honor access, correction, deletion, portability, third-party disclosure and opt-out requests, including universal opt-out signals.

Treat genetic data, and biometric data that could identify an individual, as sensitive data. Get the consumer's consent before collecting, storing or otherwise processing it, name it in the published privacy notice, and complete and document a data protection assessment because sensitive-data processing counts as a heightened risk of harm.

Adopt a written policy against discrimination, harassment and sexual assault that names an individual to receive complaints, gives a reporting route that goes around the immediate supervisor, states the five-year filing deadline, tells employees they may keep their own records, and explains the limits on non-disclosure and non-disparagement terms. Hand a copy to every new hire and to anyone who complains, and keep it posted or otherwise available in the workplace. BOLI publishes a model template.

Run a safety committee or documented safety meetings with equal employer- and employee-side representation (2 members at 20 or fewer employees, 4 above that), meet monthly (quarterly for mostly-office workplaces), and keep written minutes for three years covering hazard reports, workplace inspections, incident investigations and training. Oregon OSHA also expects the posted job safety notice and the usual injury and illness records.

Carry out periodic security and safety assessments, build and run a written assault prevention and protection program based on what those assessments find, train staff on it on an ongoing basis, and keep a log of assaults on employees that happen on the premises or in a patient's home.

Maintain a written information security program with administrative, technical and physical safeguards scaled to the size of the licensee and the sensitivity of the customer information it holds, covering access, storage, transmission and disposal. A licensee regulated primarily elsewhere may rely on a substantially similar program accepted by that regulator.

Oregon is adopting the GovRAMP vendor authorization process, run jointly by DAS State Procurement Services and EIS Cyber Security Services. It is not a blanket statutory mandate yet, so check the current phase before bidding, but a supplier planning to sell cloud services to Oregon agencies should expect to hold a GovRAMP status backed by a FedRAMP-accredited third party assessor against NIST SP 800-53 rev 5, plus continuous monitoring. Oregon's own note is that it follows NIST 800-53 but lacks pre-procurement audits, and GovRAMP is meant to fill that gap.

Display the Paid Leave Oregon model notice where employees can see it and give it to remote workers, withhold and remit contributions each quarter, and hold the employee's job and benefits during leave once they pass 90 days. An employer offering its own plan instead must file that written equivalent plan with the Employment Department for approval.

Let employees accrue at least one hour of sick time per 30 hours worked up to 40 hours a year, or front-load 40 hours; put the terms in a written sick time policy, tell employees in writing at least once a quarter how much time they have accrued and used, and post the BOLI sick time notice.

Post the current state and federal notices where employees can see them - minimum wage, sick time, family leave, Paid Leave Oregon, predictive scheduling where it applies, the Oregon OSHA job safety notice, workers' compensation, unemployment and the domestic violence and sexual harassment rights notice. BOLI refreshes the combined poster every July 1, and employers with 6 or more employees add the pregnancy accommodation notice.

Post a pay equity notice clearly at every worksite. Do not pay one employee less than another doing work of comparable character because of race, color, religion, sex, sexual orientation, gender identity, national origin, marital status, veteran status, disability or age, and do not fix a gap by cutting anyone's pay. Do not ask a job applicant for their salary or pay history before making an offer of employment, and do not screen applicants or set pay off current or past compensation. The statute gives a safe harbour: an employer that completes a good-faith equal-pay analysis, reasonable in detail and scope for its size and covering practices designed to remove unlawful wage differentials, within three years before a claim, and shows reasonable and substantial progress, has compensatory and punitive damages disallowed. That analysis is a written document worth keeping.

File formation or foreign registration papers (or an assumed business name) with the Corporation Division, name a registered agent with an Oregon street address, and file the annual report each year on the registration anniversary to stay active.

Complete the required pre-license training and exam, name a responsible managing individual, carry a surety bond and general liability insurance at the level set for the license endorsement, register the entity with the Secretary of State, and renew the CCB license every two years with continuing education. Residential contractors must also give homeowners the CCB consumer notice and information notice on procedures.

Hold a county food service facility license and keep it renewed, and make sure every food worker earns an Oregon food handler card within 30 days of starting (valid three years). A certified food manager credential is accepted in place of the card now and becomes mandatory for facilities in 2029.

Give each new hire a written good-faith estimate of their median hours and on-call expectations, post the written work schedule at least 14 days ahead, keep a voluntary standby list in writing, pay predictability pay when the schedule changes late, honor the 10-hour rest gap between shifts, and display the BOLI predictive scheduling poster.

Tell the candidate in a written offer at least two weeks before the first day of work that a noncompetition agreement is a condition of employment, or enter it only on a bona fide advancement; give the signed copy back to the employee within 30 days of separation. The agreement is void beyond 12 months and unless the employee is exempt and earns above the statutory salary floor.

Post a written notice in a conspicuous place, and give the same notice to new hires and to any employee who says they are pregnant, explaining the right to be free from discrimination because of pregnancy, childbirth and related conditions and the right to reasonable accommodation.