Oregon SaaS Agreement Review
Oregon's privacy law is one of the few that covers nonprofits, and as of 2026 it no longer gives businesses a guaranteed chance to fix violations before the attorney general sues. A Portland software studio, a Bend brewery with an online club or a Eugene nonprofit using donor management software should all check that their SaaS vendor's terms match the Oregon Consumer Privacy Act, in force since July 1, 2024.
Consumer privacy law in Oregon
Oregon Consumer Privacy Act (OCPA)
Data rights in Oregon
Oregon has enacted the Oregon Consumer Privacy Act (OCPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Oregon residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
Who is covered by the Oregon Consumer Privacy Act?
ORS 646A.572 applies to anyone doing business in Oregon or serving its residents who, in a calendar year, controls or processes personal data of 100,000 or more consumers (excluding payment-only data), or 25,000 or more while earning 25% or more of gross revenue from selling personal data. There is no general nonprofit exemption, so charities that meet a threshold are covered.
The attorney general enforces the act with civil penalties of up to $7,500 per violation under ORS 646A.589. The 30-day notice and cure step dropped out of the statute on January 1, 2026, so review vendor addenda signed when the law began and confirm they still cover every processor term the act requires.
Oregon's renewal and breach rules
Oregon's automatic renewal law, ORS 646A.295, protects consumers: offer terms must be clear and conspicuous next to the consent request, the card cannot be charged without affirmative consent, and the acknowledgment must explain an easy cancellation method. Business buyers get no statutory protection here and should negotiate equivalent terms.
Under ORS 646A.604, affected consumers must be notified no later than 45 days after a breach is discovered, and the attorney general must be told when more than 250 consumers are involved. Oregon has no sales tax, so SaaS is not taxed.
Oregon sources checked 2026-10-09: ORS 646A.572 (applicability) · ORS 646A.589 (enforcement) · ORS 646A.295 (automatic renewal) · ORS 646A.604 (breach notice). Laws change; confirm the current rule before relying on it.
Oregon SaaS agreement FAQ
Does Oregon have a data privacy law that affects SaaS contracts?
Yes. Oregon has enacted a comprehensive consumer privacy law, the Oregon Consumer Privacy Act (OCPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Oregon residents.
Can a SaaS vendor use my Oregon business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Oregon law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Oregon?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Oregon law in about a minute.
Does the Oregon privacy law apply to nonprofits using SaaS?
Yes, if the nonprofit meets the thresholds. ORS 646A.572 has no blanket nonprofit exemption, only narrow ones such as insurance fraud prevention groups. A large charity holding donor and member data on 100,000 Oregonians is a controller, and its CRM or fundraising vendor is a processor that needs a compliant contract.
Is there still a cure period under Oregon's privacy law?
No. The provision requiring the attorney general to give 30 days to cure a violation no longer appears in the statute as of January 1, 2026. The attorney general can seek civil penalties of up to $7,500 per violation without first offering a cure, so contract gaps carry more risk.
Reviewing a SaaS contract in Oregon?
Upload it and get the data, liability, and renewal terms checked against Oregon law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Oregon law when you run your agreement, and you should confirm anything critical with a qualified attorney.