Law / United States / 
Virginia
Breach of personal information notification
In force.
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Notify the Virginia Office of the Attorney General and each affected Virginia resident of a breach of system security involving personal information without unreasonable delay after discovery.
- Do not rely on this statute to cover information obtained from publicly available government records; the notification duty's personal information definition excludes it.
- Note that subsection (I) preserves an individual's recovery of direct economic damages for a violation but grants no cause of action of its own.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Virginia (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
The Office of the Attorney General may impose a civil penalty of up to $150,000 per breach of the security of the system, or per series of similar breaches discovered in a single investigation (§ 18.2-186.6(I)); enforcement against a state-chartered or licensed financial institution belongs exclusively to that institution's primary state regulator (subsection J).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 150,000
Who enforces it
Enforcement body
Virginia Office of the Attorney General; a violation by a state-chartered or licensed financial institution is enforced exclusively by that institution's primary state regulator, not the Attorney General.
Settledness
- As of
- Guidance link
- https://web.archive.org/web/2025if_/https://www.oag.state.va.us/files/Data_Breach_Notification_Req.pdf
- Guidance body
- Office of the Attorney General of Virginia
- Open questions
- Does a breach of the listed data elements trigger notice under Va. Code § 18.2-186.6(B) only where the entity reasonably believes the access 'has caused or will cause, identity theft or another fraud', or whenever it reasonably believes the information was accessed and acquired, as the Attorney General's notification requirements describe the duty?
What it reaches
How the hook was established
express
What makes it apply
Data subject residence
Obligation class
Breach notice
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- an individual or entity that owns or licenses computerized data that includes personal information
What it makes you log
Logging duty
Section 18.2-186.6 requires an owner or licensee of computerized personal information to disclose a breach to the Office of the Attorney General and each affected Virginia resident (B), a maintainer to notify the owner (D), notice to the Attorney General and the nationwide consumer reporting agencies of the timing, distribution and content of a notice sent to more than 1,000 persons (E), and a payroll service provider or employer to notify the Attorney General of a withholding-data breach (M). Each is a duty to notify, with no record of the breach, the investigation or the notice kept, produced or kept for a period. An entity's own notification procedures in subsection F are a policy that deems compliance, not a record. The Attorney General's enforcement power in subsection I names no demand for a record. The hook is the Virginia resident to whom notice is owed.
- Kind
- None
- As of
What this law does
An individual or entity that owns or licenses computerized data including personal information must disclose a breach of the security of the system to the Office of the Attorney General and any affected Virginia resident without unreasonable delay following discovery.
'Personal information' here (a Social Security, driver's license or state ID, passport, or military ID number, or a financial account number with an access code, each combined with a name) is narrower than VCDPA's 'personal data' and excludes information obtained from publicly available government records.
Unlike VCDPA, which bars a private plaintiff outright, this breach-notification chapter provides that nothing in it limits an individual from recovering direct economic damages for a violation, and grants no cause of action of its own. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .