Virginia’s Consumer Data Protection Act (VCDPA) has been signed into law, making it the second state to codify a major privacy and data protection law. Effective January 1, 2023, the VCDPA applies to personal data so long as it is not “de-identified data or publicly available information.” It also extends its protection to Virginia residents “acting only in an individual or household context,” and not to “a natural person acting in a commercial or employment context.” Organizations conducting business in Virginia or those that target Virginia residents and who either annually process personal data of 100,000 or more Virginians or process personal data of at least 25,000 Virginians while deriving more than 50 percent of their gross revenue from the sale of personal data are subject to the VCDPA.
