Law / United States / 
Virginia
Virginia Consumer Data Protection Act (VCDPA), general applicability and controller/processor duties
Va. Code Ann. §§ 59.1-575, 59.1-576, 59.1-578, 59.1-579
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Independent third party
- Where the report goes
- Produced on request
What it requires
- Confirm you conduct business in Virginia, or produce a product or service used by Virginia residents, and process or sell personal data before relying on VCDPA's scope in compliance planning.
- Obtain a Virginia consumer's opt-in consent before processing sensitive data, and treat information a consumer restricted to a specific audience as covered personal data, not as exempt publicly available information.
- Do not sell precise geolocation data collected from Virginia residents. A 2026 amendment added an outright ban on that sale.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Virginia (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf
- Guidance body
- Office of the Attorney General of Virginia
- Open questions
- Does a business have a 'reasonable basis to believe' that a consumer's public post is 'lawfully made available to the general public' under Va. Code § 59.1-575 when the platform's terms of service forbid collecting it, so that the collected data is outside 'personal data'?
What it makes you log
Who may demand the log
Counterparty
Logging duty
The processor's contract must require it, on the controller's reasonable request, to make available all information necessary to demonstrate its compliance, to allow and cooperate with the controller's assessments or arrange an independent assessor, and to give the controller the assessment report on request. None of that can be met without a kept record, but the section names no log, content or period. Section 59.1-579(A)(3) has the processor give the controller the information to conduct and document a data protection assessment under section 59.1-580, whose documentation duty and the Attorney General's right to a disclosed assessment are in a section this row does not cite. The privacy notice and the security practices in 59.1-578 are policies, and 59.1-575 and 59.1-576 define terms and scope. The consumer definition in 59.1-575 adds a residence test, left out of the hook because the operative reach of these sections is the scope clause.
- Kind
- Implicit
- As of
- Provision
- Va. Code Ann. 59.1-579(B)(3) and (B)(4)
- Trigger
- personal_data_processing
What this law does
VCDPA governs private-sector processing of Virginia residents' personal data. Enacted in the 2021 Special Session I (cc. 35, 36), effective . Controllers need a lawful basis for processing outside disclosed purposes and opt-in consent for sensitive data; controller duties are allocated at section 59.1-578 and processor duties, including a required data-processing contract, at section 59.1-579.
A 2026 amendment (S.B. 338, Ch. 820) added a ban on the sale of precise geolocation data, effective and already reflected in the codified text.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .