Virginia Data Privacy and Breach Notification Laws for Small Businesses

Updated October 22, 2026

Two Virginia laws come up most often when small businesses ask about data: the Virginia Consumer Data Protection Act (VCDPA) and the state’s data breach notification law. Most small businesses aren’t covered by the first. Nearly every business is covered by the second.

This page is general information, not legal advice. Laws change, and the details matter. Check the statutes linked below and talk to your attorney about your specific situation.

The Virginia Consumer Data Protection Act (VCDPA)

The VCDPA (Va. Code § 59.1-575 et seq.) took effect January 1, 2023. It gives Virginia residents rights over their personal data, including access, correction, deletion, and opting out of targeted advertising and the sale of their data.

Does it apply to your business?

It applies to businesses that operate in Virginia or target Virginia residents, and that in a calendar year either:

• control or process personal data of at least 100,000 Virginia consumers, or
• control or process personal data of at least 25,000 Virginia consumers and get more than 50% of gross revenue from selling personal data.

Most small and mid-sized businesses fall well below these thresholds. The law also exempts several categories entirely, including:

• Nonprofit organizations
• Financial institutions covered by the federal Gramm-Leach-Bliley Act
• HIPAA covered entities and business associates
• Institutions of higher education

The Virginia Attorney General enforces the VCDPA. There’s no private right of action, so individuals can’t sue under it directly.

If you’re near the threshold

Businesses with large customer lists, ecommerce operations, or marketing databases should count carefully. The thresholds count consumers, not customers, so newsletter subscribers and website visitors you can identify may count.

Virginia’s data breach notification law

Virginia’s breach notification law (Va. Code § 18.2-186.6) applies to any business that owns or licenses computerized personal information about Virginia residents. There’s no size threshold.

What counts as personal information

Generally, a person’s first name or first initial and last name, combined with any of:

• Social Security number
• Driver’s license or state ID number
• Financial account, credit card, or debit card number, combined with any code or password that allows access to the account
• Passport number
• Military ID number

The law applies when this information is unencrypted, or when it’s encrypted and the key was also compromised. Medical information is covered by a separate Virginia statute (§ 32.1-127.1:05).

What you have to do

If you discover or are notified of a breach that you reasonably believe has caused or will cause identity theft or other fraud, you must notify:

• The Virginia Office of the Attorney General, and
• Affected Virginia residents,

without unreasonable delay. If more than 1,000 residents are notified at one time, you must also notify the Attorney General and the nationwide consumer reporting agencies of the timing, distribution, and content of the notice.

The statute specifies what the notice to individuals must contain. If a vendor that holds your data has the breach, they must notify you, and you remain responsible for notifying your customers.

Practical steps before a breach

• Know where personal information lives. Spreadsheets of customer SSNs, scanned driver’s licenses in email, and old files on a shared drive are common surprises.
• Encrypt laptops and phones. Losing an encrypted laptop generally doesn’t trigger notification. Losing an unencrypted one might.
• Keep less. Data you’ve deleted can’t be breached.
• Check your cyber insurance. Most policies include breach coaches and legal counsel who handle notification. Know the hotline before you need it.

Federal rules that often matter more

For many Virginia small businesses, federal rules are the bigger compliance obligation:

• FTC Safeguards Rule (16 CFR Part 314): applies to many “financial institutions” in the broad federal sense, including tax preparers, mortgage brokers, auto dealers, and some others. It requires a written information security program, a designated responsible person, MFA, encryption, and (since May 2024) notifying the FTC of certain breaches affecting 500 or more people. See our guide for accounting and tax firms.
• HIPAA: medical and dental practices, and their business associates. See IT for medical and dental practices.
• PCI DSS: any business that accepts credit cards. Your payment processor sets the specific requirements.
• Professional rules: lawyers and CPAs have confidentiality duties that extend to how they store and send client data. See IT for law firms.

Where to start

1. Make a simple list of where you store Social Security numbers, financial account numbers, ID numbers, and health information.
2. Make sure every laptop is encrypted (BitLocker on Windows, FileVault on Mac).
3. Find out whether you’re covered by the FTC Safeguards Rule or HIPAA. If you are, those requirements come first.
4. Put your cyber insurer’s breach hotline in your incident plan.