Law / United States / 
Virginia
Virginia Consumer Data Protection Act (VCDPA), data protection assessments
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection assessment of your processing of personal data for targeted advertising, its sale, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, the processing of sensitive data, and any other processing that presents a heightened risk of harm to Virginia consumers (section 59.1-580(A)).
- If you offer an online service, product or feature directed to consumers you have actual knowledge are children, conduct a data protection assessment of it that addresses its purpose, the categories of known children's personal data it processes and your purposes for processing them (section 59.1-580(B)).
- In each assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, factoring in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (section 59.1-580(C)).
- Make a data protection assessment available to the Attorney General when the Attorney General requests it under a civil investigative demand (section 59.1-580(D)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment of each processing activity the section lists (59.1-580(A)), and of a service directed to known children (59.1-580(B)), weighing the benefits of the processing against the risks as safeguards mitigate them (59.1-580(C)). The Attorney General may request, through a civil investigative demand, any assessment relevant to an investigation, and the controller must make it available; the Attorney General may evaluate it for compliance with 59.1-578 (59.1-580(D)). Assessments are confidential and exempt from the Virginia Freedom of Information Act. The section sets no period for keeping an assessment. The section has no scope clause; the reach is in 59.1-576, which the duties row cites and this row does not, so no hook is taken.
- Kind
- Explicit
- As of
- Provision
- Va. Code Ann. 59.1-580(A) to (D) (documented data protection assessments)
- Trigger
- personal_data_processing
What this law does
A controller must conduct and document a data protection assessment of processing for targeted advertising, the sale of personal data, certain profiling, the processing of sensitive data and any processing that presents a heightened risk of harm to consumers. A controller that offers an online service, product or feature directed to consumers it has actual knowledge are children must conduct a data protection assessment for it.
The Attorney General may request, pursuant to a civil investigative demand, that a controller disclose any data protection assessment relevant to an investigation, and the controller must make it available to the Attorney General. Data protection assessments are confidential and exempt from public inspection and copying under the Virginia Freedom of Information Act. The assessment requirements apply to processing activities created or generated after , and are not retroactive.
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web, deploys a chatbot, processes biometric data, processes voice recordings, trains models or makes high-risk automated decisions.