THE VIRGINIA CONSUMER DATA PROTECTION ACT AND ITS EFFECTS ON
YOUR IT AGREEMENTS
In early March, Governor Northam of Virginia signed into law the
Virginia Consumer Data Protection Act (VCDPA). Effective
January 1, 2023, this new Act will require businesses that
do significant business in Virginia or produce products or services
targeted to Virginia consumers to protect the data of those
residents in various specified ways, unless they can claim an
exemption under the Act. Virginia is the second state, after
California, to enact comprehensive privacy legislation, though
it's likely to be far from the last. The VCDPA requires
affected businesses to adopt specified privacy-protecting measures,
give their customers certain rights, and provide specific notices
to the public. It also expressly requires businesses'
agreements with IT providers who handle personal information to
include specific obligations. Thus, over the next twenty months, it
is critical for companies
