LexLint

Know the law your code answers to.

Law / United States / Virginia

Breach of personal information notification

Va. Code Ann. § 18.2-186.6

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A breach notification rule binding public and private bodies.

As of 2 September 2026.

What it requires

  • Notify the Virginia Office of the Attorney General and each affected Virginia resident of a breach of system security involving personal information without unreasonable delay after discovery.
  • Do not rely on this statute to cover information obtained from publicly available government records; the notification duty's personal information definition excludes it.
  • Expect an individual affected by a violation of this notification duty to be able to sue for direct economic damages; unlike VCDPA, this chapter does not bar a private plaintiff.

If you get it wrong

Criminal exposureNo

Private right of actionYes

Penalty structure

The Office of the Attorney General may impose a civil penalty of up to $150,000 per breach of the security of the system, or per series of similar breaches discovered in a single investigation (§ 18.2-186.6(I)); enforcement against a state-chartered or licensed financial institution belongs exclusively to that institution's primary state regulator (subsection J).

Rule
Per violation only
As of
2 September 2026
Currency
USD
Per violation unit
Violation
Per violation amount
150,000

Who enforces it

Enforcement body

Virginia Office of the Attorney General; a violation by a state-chartered or licensed financial institution is enforced exclusively by that institution's primary state regulator, not the Attorney General.

What it reaches

Obligation class

Breach notice

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

An individual or entity that owns or licenses computerized data including personal information must disclose a breach of the security of the system to the Office of the Attorney General and any affected Virginia resident without unreasonable delay following discovery.

'Personal information' here (a Social Security, driver's license or state ID, passport, or military ID number, or a financial account number with an access code, each combined with a name) is narrower than VCDPA's 'personal data' and excludes information obtained from publicly available government records.

Unlike VCDPA, which bars a private plaintiff outright, this breach-notification chapter expressly preserves an individual's right to recover direct economic damages for a violation of the notification duty. This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach

Read the law

official Virginia statute text, Title 18.2 Chapter 6, Code of Virginia

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app