VCDPA: The Complete Guide
The Virginia Consumer Data Protection Act was the second comprehensive state privacy law enacted in the United States, signed into law in March 2021 and effective January 1, 2023. The VCDPA establishes consumer rights over personal data and imposes obligations on controllers and processors operating in Virginia.
What the VCDPA Covers
The VCDPA grants Virginia consumers five core rights: the right to access their personal data, the right to correct inaccuracies, the right to delete data, the right to obtain a portable copy, and the right to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.
The law distinguishes between controllers (entities that determine the purpose and means of processing) and processors (entities that process data on behalf of controllers), imposing distinct obligations on each. Controllers must limit data collection to what is adequate, relevant, and reasonably necessary for disclosed purposes.
Who Needs to Comply
The VCDPA applies to entities that conduct business in Virginia or target Virginia residents and that, during a calendar year, either control or process the personal data of at least 100,000 Virginia consumers, or control or process the data of at least 25,000 consumers while deriving over 50% of gross revenue from the sale of personal data.
Notably, the VCDPA exempts entities and data already regulated under HIPAA, the Gramm-Leach-Bliley Act, and several other federal laws. Nonprofits and higher education institutions are also exempt.
Enforcement
The Virginia Attorney General has exclusive enforcement authority. There is no private right of action. Before initiating enforcement, the Attorney General must provide a 30-day cure period. Civil penalties reach up to $7,500 per violation.
Practical Compliance Steps
- Determine applicability — Assess whether processing thresholds are met for Virginia consumers
- Map data flows — Identify all personal and sensitive data processing activities
- Consent mechanisms — Implement opt-in consent for sensitive data processing
- Consumer rights — Build request intake and response workflows within 45-day deadlines
- Data protection assessments — Conduct assessments for targeted advertising, profiling, and sensitive data activities
- Processor contracts — Execute agreements meeting VCDPA requirements with all processors