Virginia. Breach notification. Act
VA breach lawVirginia data breach notification law (Va. Code §§ 18.2-186.6, 32.1-127.1:05)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Virginia residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN, driver's licence/ID, financial account with codes, passport, military ID; separate medical-information breach law.
- Key themes
- Unique features
Separate notice regime for medical information to the Commissioner of Health; employers must notify AG of breaches of employee tax withholding data.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Virginia requires the maintaining entity to notify the owner without unreasonable delay. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay; AG for any notifiable breach (and Commissioner of Health for health data); CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $150,000 per breach or series of breaches
§3Dates
- Key dates
- Adopted
- In force
- HB 2396 (2019, eff. 2019-07-01) added passport and military ID; HB 2113 (2017) tax information
§4Text and authority
- Text
- Authoritative text law.lis.virginia.gov
- Authority
- Virginia Attorney General
§5Where it applies
- Domestic law of
- Virginia
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.