Virginia Becomes The Second State To Enact A Comprehensive Data Privacy Law

Virginia has become the second U.S. state to enact a comprehensive data privacy law. On March 2, 2021, Governor Ralph Northam signed the Virginia Consumer Data Protection Act ("the Act") into law, after the draft legislation had sailed through the Virginia legislature in a matter of weeks. The Act takes effect January 1, 2023.

The Act will apply to persons or entities that conduct business in Virginia or produce products or services targeting Virginia residents, and that (i) during a calendar year, control or process personal data of at least 100,000 Virginia consumers or (ii) control or process personal data of at least 25,000 Virginia consumers and derive more than 50% of gross revenue from the sale of personal data.