Comprehensive Data Privacy Law Brings Big Changes To Virginia, But Excludes Employee Personal Data

Virginia has joined California as the second state to enact a comprehensive data privacy law. On March 2, 2021, Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act (VCDPA) into law. The VCDPA does not go into effect until January 1, 2023, but the broad privacy mandate will have an immediate impact on compliance efforts for many Virginia businesses.

The law includes elements similar to those found in the California Consumer Privacy Act (CCPA) and the newly enacted California Privacy Rights Act (CPRA), such as provisions granting Virginia residents the right to access, correct, delete, know about, and opt out of the sale and processing of their personal information for "targeted advertising" purposes. Similar to the European Union's privacy analog, the General Data Protection Regulation (GDPR), the VCDPA imposes data security and consumer response obligations on the data "controller" and "processor" for certain businesses handling