Virginia Enacts Consumer Data Protection Act

The Governor of Virginia signed the state's Consumer Data Protection Act (VCDPA) into law, marking it the second state in the U.S. to codify a major privacy and data protection law, after California. The VCDPA follows some of the arrangements of the California Consumer Privacy Act (CCPA) as amended by the Consumer Privacy Rights Act (CPRA), but still departs from them in important parts.

Effective January 1, 2023, the VCDPA applies to personal data so long as it is not "de-identified data or publicly available information". Importantly, the VCDPA extends its protection to Virginia residents "acting only in an individual or household context", and not to "a natural person acting in a commercial or employment context". Organizations subject to the VCDPA are those conducting business in Virginia or targeting Virginia residents, and who either annually process personal data of 100,000 or more Virginians or process personal data of at least 25,000 Virginians while