Unlock unlimited alerts, exports & API access — RuleWatch Pro at $29/mo
Regulation dossier
A focused view of the rule, its enforcement posture, and the timeline teams should keep in their operating plan.
Plain-English summary
Virginia gives consumers rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, sale, and certain profiling. It applies to controllers and processors that meet statutory thresholds and requires privacy notices, data protection assessments, and contracts with processors. Sensitive data processing generally needs consumer consent.
Reading guide
Use the timeline below to see how the rule progressed from enactment to current obligations.
Related regulations surface adjacent requirements in the same jurisdiction or policy lane.
Timeline
Jan 13, 2021
Virginia lawmakers introduced the Consumer Data Protection Act as a comprehensive state privacy bill.
Mar 2, 2021
The governor signed the Virginia Consumer Data Protection Act into law.
Jan 1, 2023
Virginia's comprehensive privacy rights and controller obligations became effective.
Get email alerts when this regulation changes and export records to CSV for your compliance workflow — available with RuleWatch Pro.
Subscribe for regulation alerts
Free weekly digest for compliance professionals following material legal changes.
Related regulations
Pulled from the same jurisdiction or category so teams can compare adjacent obligations quickly.
Virginia, United States
Virginia now requires human decision-makers to remain responsible for major criminal justice decisions even when AI-based tools generate recommendations or predictions. It affects judicial officers and other criminal-justice decision-makers by limiting AI to an assistive role and preserving opportunities to challenge AI outputs.
Virginia, United States
Virginia requires entities and state agencies that suffer qualifying breaches involving personal information to notify affected residents and, in many cases, the Attorney General. It affects businesses and public bodies that own or license personal information and sets timelines, notice content expectations, and substitute-notice rules.
Indiana, United States
Indiana gives consumers rights to confirm processing, access data, correct inaccuracies, delete certain personal data, obtain portable copies, and opt out of targeted advertising, sale, and profiling. It applies to businesses that meet threshold tests and requires clear notices, purpose limitation, security safeguards, and contracts with processors. The attorney general enforces the law after a cure process.