Virginia Passes Comprehensive Data Privacy Law – Mintz's Hot Take

On Tuesday, Virginia Governor Ralph Northam signed the Consumer Data Protection Act ("CDPA") into law, making Virginia the second U.S. state after California to pass a comprehensive data privacy law. Those familiar with the European Union General Data Protection Regulation (GDPR) will recognize terminology throughout the CDPA, mimicking many GDPR-defined terms, such as "controller", "processor" and "personal data." While not quite as expansive as the GDPR in every respect, the CDPA is a very broad-based privacy law that is on par with the California Consumer Privacy Act. Below, we break down some of its key elements.

To whom does the CDPA apply?

The CDPA applies to persons that conduct business in Virginia or produce products or services that are targeted to Virginia residents that: (i) during a calendar year, control or process personal data of at least 100,000 consumers; or (ii) control or process personal data of at least 25,000 consumers and derive over 50%