Processes personal data, in Virginia

Va. Code Ann. § 59.1-478 · Read the law's page

• If you require another person to furnish a fingerprint or fingerprints in conjunction with a business, commercial or financial transaction, then, unless the parties otherwise agree, within 21 days of the transaction's completion or termination return to the person the original record of the prints and all copies, including electronic or facsimile copies, or destroy them.

Va. Code Ann. § 59.1-443.2 · Read the law's page

• Except as otherwise specifically provided by law, do not intentionally communicate another individual's social security number to the general public (section 59.1-443.2(A)(1)).
• Do not print an individual's social security number on any card required for the individual to access or receive products or services you provide (section 59.1-443.2(A)(2)).
• Do not require an individual to use a social security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required to access the site (section 59.1-443.2(A)(3)).
• Do not send or cause to be sent or delivered a letter, envelope or package that displays a social security number on the face of the mailing envelope or package, or from which one is visible, whether on the outside or inside (section 59.1-443.2(A)(4)).
• Do not embed an encrypted or unencrypted social security number in or on a card or document, including by a bar code, chip, magnetic strip or other technology, in place of removing it as the section requires (section 59.1-443.2(E)).

Va. Code Ann. § 59.1-577 · Read the law's page

• Give a Virginia consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Virginia consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.

Va. Code Ann. § 59.1-580 · Read the law's page

• Conduct and document a data protection assessment of your processing of personal data for targeted advertising, its sale, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, the processing of sensitive data, and any other processing that presents a heightened risk of harm to Virginia consumers (section 59.1-580(A)).
• If you offer an online service, product or feature directed to consumers you have actual knowledge are children, conduct a data protection assessment of it that addresses its purpose, the categories of known children's personal data it processes and your purposes for processing them (section 59.1-580(B)).
• In each assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, factoring in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (section 59.1-580(C)).
• Make a data protection assessment available to the Attorney General when the Attorney General requests it under a civil investigative demand (section 59.1-580(D)).

Va. Code Ann. §§ 59.1-575 and 59.1-581 · Read the law's page

• Before treating data as de-identified, take reasonable measures to ensure that it cannot be associated with a natural person (section 59.1-581(A)(1)).
• Publicly commit to maintaining and using the de-identified data without attempting to re-identify it (section 59.1-581(A)(2)).
• Contractually obligate every recipient of the de-identified data to comply with all provisions of the Consumer Data Protection Act (section 59.1-581(A)(3)).
• When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breaches of those commitments (section 59.1-581(E)).

Va. Code Ann. §§ 59.1-575, 59.1-576, 59.1-578, 59.1-579 · Read the law's page

• Confirm you conduct business in Virginia, or produce a product or service used by Virginia residents, and process or sell personal data before relying on VCDPA's scope in compliance planning.
• Obtain a Virginia consumer's opt-in consent before processing sensitive data, and treat information a consumer restricted to a specific audience as covered personal data, not as exempt publicly available information.
• Do not sell precise geolocation data collected from Virginia residents. A 2026 amendment added an outright ban on that sale.

Va. Code Ann. §§ 59.1-583, 59.1-584 · Read the law's page

• Cure a noticed violation and provide a written statement of cure within 30 days of Attorney General notice to avoid an enforcement action. Unlike some peer states, Virginia's cure right carries no sunset date in the statutory text.

Va. Code Ann. § 59.1-593 · Read the law's page

• To treat genetic information as deidentified, take reasonable measures to ensure that it cannot be associated with a consumer or household (section 59.1-593, definition of deidentified data, clause (i)).
• Publicly commit to maintain and use the information only in deidentified form and not to attempt to reidentify it, except solely to test whether your deidentification processes satisfy the definition, and then neither use nor disclose any information reidentified in that test and destroy it when the assessment is complete (section 59.1-593, clause (ii)).
• Contractually obligate every recipient of the information to take reasonable measures to ensure that it cannot be associated with a consumer or household and to commit to using it only in deidentified form and not to reidentify it (section 59.1-593, clause (iii)).

Va. Code Ann. §§ 59.1-593 to 59.1-602 · Read the law's page

• If you are a direct-to-consumer genetic testing company, give Virginia consumers, in plain language with any genetic testing product and on your website, a summary of your policies and procedures on the collection, use, maintenance, retention, disclosure, transfer, deletion and security of genetic data and on access to it, a summary of your privacy practices, information on the express-consent requirement and the process for revoking consent, notice that deidentified genetic or phenotypic data may be shared with third parties for research, and the process for filing a complaint alleging a violation (section 59.1-595).
• Obtain a consumer's express consent for the collection, use and disclosure of genetic data, never inferred from inaction, with separate and express consent for the use of the data collected (including who receives access, how it is shared and the purposes), for storing the biological sample after the initial testing, for each use of the data or sample beyond the primary purpose and inherent contextual uses, for each transfer or disclosure to a third party other than a service provider (naming the third party), and for any marketing or facilitation of marketing based on the data, except marketing on your own website or mobile application that meets the three conditions of section 59.1-596(B)(5).
• Give a consumer a mechanism to revoke express consent, including through the primary medium through which you communicate with consumers, honor a revocation as soon as practicable and in all cases within 30 days of receipt, and destroy the consumer's biological sample within 30 days of receiving revocation of consent to store it (section 59.1-596(C) and (D)).
• Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure (section 59.1-597).
• Develop procedures and practices that let a consumer easily access the consumer's genetic data, delete it (except data that state or federal law requires you to retain, and any account the consumer created), and revoke express consent to storage of the biological sample and request its destruction (section 59.1-597).
• Bind every service provider that handles a consumer's biological sample, extracted genetic material, genetic data or identity information by contract not to retain, use or disclose them for any purpose other than the specific services in the contract, and not to associate or combine them with information the provider receives from or on behalf of another person or collects from its own interaction with consumers (section 59.1-598).
• Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises such an entity, without the consumer's express consent (section 59.1-599).
• Do not discriminate against a consumer for exercising rights under the chapter, whether by denying or changing goods, services or benefits, charging a different price or rate, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis or suspicion of criminal wrongdoing or unlawful conduct. This duty binds a person or a public entity (section 59.1-600).

Va. Code Ann. 59.1-200(A)(85) (2025 Va. Acts ch. 591) · Read the law's page

• If you are a supplier dealing with Virginia consumers, do not obtain, disclose, sell, or disseminate a consumer's personally identifiable reproductive or sexual health information without the consumer's consent, including location information that may indicate an attempt to obtain reproductive or sexual health services or supplies.
• Obtain the consumer's consent before obtaining, disclosing, selling, or disseminating reproductive or sexual health information that you derive or extrapolate from non-health data by proxy, inference, or algorithm.

Va. Code Ann. § 18.2-186.6 · Read the law's page

• Notify the Virginia Office of the Attorney General and each affected Virginia resident of a breach of system security involving personal information without unreasonable delay after discovery.
• Do not rely on this statute to cover information obtained from publicly available government records; the notification duty's personal information definition excludes it.
• Note that subsection (I) preserves an individual's recovery of direct economic damages for a violation but grants no cause of action of its own.

Va. Code Ann. § 38.2-613(B)(8) · Read the law's page

• If you are an insurance institution, agent or insurance-support organization disclosing personal or privileged information about an individual for an actuarial or research study without the individual's written authorization, make sure no individual may be identified in any actuarial or research report, return or destroy the materials that allow the individual to be identified as soon as they are no longer needed, and get the actuarial or research organization to agree not to disclose the information unless the disclosure would otherwise be permitted by section 38.2-613 if made by an insurance institution, agent or insurance-support organization (section 38.2-613(B)(8)).