West Virginia. Breach notification. Act
WV breach lawWest Virginia data breach notification law (W. Va. Code § 46A-2A-101 et seq.)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about West Virginia residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN, driver's licence/ID, financial account with codes.
- Key themes
- Unique features
Civil penalties only for repeated and wilful violations.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: West Virginia requires the maintaining entity to notify the owner as soon as practicable. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $150,000 per breach for repeated and wilful violations
§3Dates
- Key dates
- Adopted
- In force
- No amendment identified since enactment
§4Text and authority
- Text
- Authoritative text code.wvlegislature.gov
- Authority
- West Virginia Attorney General
§5Where it applies
- Domestic law of
- West Virginia
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.