Law / United States / 
West Virginia
Breach of Security of Consumer Information
W. Va. Code secs. 46A-2A-101 to 46A-2A-105
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A breach notification rule binding private bodies.
As of 28 August 2026.
What it requires
- Notify each affected West Virginia resident of a breach of security involving personal information without unreasonable delay.
- Notify each nationwide consumer reporting agency if you are required to notify more than 1,000 persons of a breach.
- Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. It does not fold any of those into personal information.
- Expect this Act's notice duty to be enforced exclusively by the West Virginia Attorney General (or, for a licensed financial institution, its primary regulator), never by a private plaintiff, even though a violation is deemed an unfair trade practice.
If you get it wrong
Private right of actionNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
An individual or entity that owns or licenses computerized data including personal information must give notice of a breach of the security of the system, without unreasonable delay, to any West Virginia resident whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person, where the breach causes or is reasonably believed to cause identity theft or other fraud.
Personal information is name plus a Social Security number, driver's license or state ID number, or a financial account number with access credential; health information, biometric data, and genetic data are not folded into this definition, unlike South Dakota's narrower biometric fold-in researched alongside this state. An entity required to notify more than 1,000 persons of a breach must also notify nationwide consumer reporting agencies.
A notice violation is deemed an unfair or deceptive act under West Virginia's general Consumer Credit and Protection Act, but the Attorney General has exclusive authority to bring that action (except against a licensed financial institution, enforced instead by its own primary regulator), which closes the private right of action that West Virginia's general unfair-trade-practices statute, W. Va. Code sec. 46A-6-106, would otherwise open for 'any person who purchases or leases goods or services' suffering an ascertainable loss.
This Act's own codified page carries no separate commencement date beyond its 2008 Regular Session enactment (S.B. 340), so no effective date is recorded here.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.