Virginia Legislature Proposes Amendments To Its Consumer Data Protection Act

Virginia lawmakers are considering multiple amendments to Virginia's Consumer Data Protection Act (CDPA). These amendments mostly address a variety of open issues under the law, including the right to cure, how businesses can process deletion requests, and the scope of the law's non-profit exemption. These changes were inspired by a report published in November of 2021 by a working group that was established under the law to suggest improvements. We have summarized these potential amendments to the CDPA below. 

These proposals are notable because the CDPA does not provide the Virginia attorney general with any rulemaking authority (unlike the privacy laws in Colorado and California). This means that any changes to the law, including those relating to its technical administration, must be done by the Virginia legislature. While the Virginia legislature is looking to address some of the open issues in the law, companies will have less guidance overall on how