Oregon OCPA and Texas TDPSA Take Effect
The Oregon Consumer Privacy Act (OCPA) and Texas Data Privacy and Security Act (TDPSA) became effective, continuing the expansion of state-level privacy regulation. Oregon's law is notable for having no revenue threshold, applying to any entity processing 100,000 Oregon consumers' data or 25,000 consumers' data when deriving 25% of revenue from data sales. Texas's TDPSA is significant due to the state's large population and economy, substantially expanding the number of consumers covered by comprehensive privacy laws.
Key Analytics
Impact Analysis
Oregon's broad applicability threshold means smaller organizations that previously fell below other states' thresholds may now be subject to comprehensive privacy obligations. Texas's law, given the state's economic significance, effectively ensures that most national businesses are now subject to at least one comprehensive state privacy law. The cumulative effect of multiple state laws taking effect creates a compliance environment where a unified, privacy-by-default approach is more efficient than jurisdiction-specific implementations.
Recommended Actions
- Reassess organizational applicability under Oregon's lower thresholds, particularly if your organization processes data of Oregon residents but previously determined other state laws did not apply.
- Expand data subject request fulfillment processes to cover Texas and Oregon residents, ensuring response timeframes and verification procedures meet each state's specific requirements.
- Evaluate whether adopting the most restrictive state privacy requirements as a national baseline is more cost-effective than maintaining separate compliance programs for each jurisdiction.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Oregon and Texas applicability reassessment
- ›Rights request workflow extension with state response timeframes
- ›National baseline versus per-state compliance cost analysis
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 75 to 165 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.