Virginia Consumer Data Protection Act (VA-CDPA)
The bill grants consumer rights to access, correct, delete, and obtain a copy of personal data and to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling of the consumer. It also mandates a business "establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data."
Is Complying with VA-CDPA Mandatory?
Yes is you conduct business in Virginia or produce products or services that are targeted to Virginia residents and that either:
Control or process the personal data of at least 100,000 consumers during a calendar year.
Control or process the personal data of at least 25,000 consumers and derive at least 50% of its gross revenue from the sale of personal data.
What are the penalties for not complying with VA-CDPA?
The controller then has 30 days to cure the violation and provide the attorney general with an "express written statement that the alleged violations have been cured and that no further violations shall occur." If the controller fails to cure the violation, the attorney general may fine them up to $7,500 per violation.