# Regulatory Standards — VCDPA Compliance

## Primary Legislation

### Virginia Consumer Data Protection Act — Va. Code §59.1-575 through §59.1-585

Enacted: March 2, 2021 (SB 1392 / HB 2307). Effective: January 1, 2023.

Key provisions:
- **§59.1-575**: Definitions — consumer, controller, processor, personal data, sensitive data, targeted advertising, sale, profiling
- **§59.1-576**: Applicability — 100,000 consumers OR 25,000 consumers + 50% revenue from sale
- **§59.1-577**: Five consumer rights (access, correct, delete, portability, opt-out)
- **§59.1-578**: Controller duties (minimization, purpose limitation, security, consent for sensitive data, privacy notice, response timelines)
- **§59.1-579**: Processor contracts and obligations
- **§59.1-580**: Data protection impact assessments
- **§59.1-581**: De-identified data provisions
- **§59.1-582**: Limitations (does not restrict controller from complying with law, cooperating with law enforcement, etc.)
- **§59.1-583**: Consumer rights request procedures and appeals
- **§59.1-584**: AG enforcement and 30-day cure period
- **§59.1-585**: Relation to other laws

### 2022 Amendments (SB 534, HB 714)

Technical amendments clarifying:
- Definition of "nonprofit organization" for exemption purposes
- Scope of "personal data" exclusion for publicly available information
- Processor sub-contracting requirements

## Comparison with Other State Laws

| Provision | VCDPA (Virginia) | CCPA/CPRA (California) | CPA (Colorado) | CTDPA (Connecticut) |
|-----------|------------------|----------------------|-----------------|---------------------|
| Effective date | Jan 1, 2023 | Jan 1, 2020 / Jan 1, 2023 | Jul 1, 2023 | Jul 1, 2023 |
| Thresholds | 100K consumers OR 25K + 50% revenue | $25M revenue OR 100K consumers OR 50% revenue | 100K consumers OR 25K + revenue from sale | 100K consumers OR 25K + 25% revenue |
| Private right of action | No | Yes (data breach only) | No | No |
| Nonprofit exemption | Yes | No (for-profit only) | Yes | Yes |
| GLBA exemption | Entity-level | Data-level | Entity-level | Entity-level |
| HIPAA exemption | Entity-level | Data-level | Entity-level | Entity-level |
| Sensitive data | Opt-in consent | Post-collection limit right | Opt-in consent | Opt-in consent |
| Universal opt-out | Not required | Required (GPC) | Required (Jul 2024) | Required (Jan 2025) |
| Cure period | 30 days (permanent) | Eliminated by CPRA | 60 days (sunsets Jan 2025) | 60 days (sunsets Dec 2024) |
| Enforcement | AG only | CPPA + AG | AG only | AG only |
| DPIA required | Yes | Pending CPPA rulemaking | Yes | Yes |

## Related Virginia Laws

### Virginia Personal Information Privacy Act — Va. Code §18.2-186.6

Identity theft protections requiring businesses to safeguard personal identifying information.

### Virginia Breach Notification Act — Va. Code §18.2-186.6

Requires notification to affected individuals and the AG following a breach of unencrypted or unredacted personal information.

### Virginia Insurance Data Security Act — Va. Code §38.2-621 through §38.2-629

Establishes data security standards for licensed insurers, applicable in addition to VCDPA requirements for insurance entities not otherwise exempt.

## AG Guidance

The Virginia AG has not published formal VCDPA guidance documents as of 2025. The AG's office has conducted investigations and issued civil investigative demands but has not publicized enforcement actions with the same transparency as California's AG or CPPA.

Industry guidance from the IAPP and Virginia State Bar has emphasized that:
- The VCDPA's GDPR-like controller-processor model requires clearer role delineation than the CCPA
- The opt-in consent requirement for sensitive data is a higher standard than CCPA's limit right
- DPIAs should follow established methodologies (NIST Privacy Framework, ISO 27701) in the absence of Virginia-specific guidance