Virginia Privacy Compliance Checklist

Virginia Consumer Data Protection Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

Compliance Steps

Effective: January 1, 2023 | Cure period: 30 days

Determine whether your organization meets VCDPA applicability thresholds: (a) process personal data of 100,000+ Virginia consumers, or (b) process data of 25,000+ Virginia consumers and derive 50%+ of gross revenue from data sales. Check exemptions — HIPAA-covered entities, GLBA-regulated financial institutions, nonprofits, and higher education institutions are exempt.

Conduct a data inventory to map what personal data you collect about Virginia consumers, including categories of data, processing purposes, third-party sharing, and data retention periods. Identify any sensitive data categories (racial/ethnic origin, health data, sexual orientation, biometrics, children's data, precise geolocation).

Update your privacy notice to include all VCDPA-required disclosures: categories of personal data processed, purposes of processing, how consumers can exercise their rights, categories of data shared with third parties, and contact information. Privacy notices must be reasonably accessible and clear.

Implement consumer rights request processes with a 45-day response window (extendable by 45 additional days with notice). Support requests for access, correction, deletion, portability, and opt-out of sale/targeted advertising/profiling.

Obtain opt-in consent before processing any sensitive personal data. This includes data about health, race, religion, sexual orientation, biometrics, children's data, and precise geolocation. Consent must be freely given, specific, informed, and unambiguous.

Conduct and document data protection assessments (DPAs) for each processing activity that presents a heightened risk of harm: targeted advertising, sale of personal data, profiling with legal or significant effects, sensitive data processing, and any processing involving minors' data.

Establish a consumer appeals process: if you deny a consumer rights request, provide a mechanism for the consumer to appeal. You must respond to appeals within 60 days and include instructions for filing a complaint with the Virginia AG if the appeal is denied.

Review data processor agreements to ensure they include VCDPA-required terms: clear processing instructions, confidentiality obligations, deletion/return of data requirements, audit rights, and subprocessor management obligations.

Comply with SB 338 (signed April 13, 2026, effective July 1, 2026): if your business sells precise geolocation data, cease all sales by July 1, 2026 to comply with the geolocation data sale ban. Audit data broker relationships involving location data and terminate any agreements that involve selling Virginia consumers' precise geolocation.

Ensure minor protections compliance: platforms serving users under 18 must limit screen time features, disable addictive design patterns, and obtain parental consent for children under 13 consistent with COPPA. Monitor Virginia AG enforcement guidance for specific technical requirements.

VCDPA Compliance Checklist FAQ

What is the VCDPA compliance checklist?

It is a 10-step plan organizations use to meet the Virginia Consumer Data Protection Act (VCDPA), which took effect January 1, 2023. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under Virginia law.

Who has to comply with the Virginia Consumer Data Protection Act?

The VCDPA generally applies to organizations that handle Virginia residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for VCDPA non-compliance?

The Virginia Attorney General can impose civil penalties of up to $7,500 per violation and a 30-day cure period to fix violations before a fine. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put VCDPA Into Practice on Your Site

Termly builds and maintains a Virginia-ready privacy policy, a cookie consent banner, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests VCDPA grants.

Affiliate link — we may earn a commission, at no cost to you.

Start Free with Termly

Virginia Privacy Compliance Checklist

Compliance Steps

Key Enforcement Details

Related Resources

VCDPA Compliance Checklist FAQ

What is the VCDPA compliance checklist?

Who has to comply with the Virginia Consumer Data Protection Act?

What is the penalty for VCDPA non-compliance?

Does this law apply to you?

Official Resources