Meet VCDPA privacy duties with controls you already run

The Virginia Consumer Data Protection Act (VCDPA) is a comprehensive consumer privacy law, codified at Chapter 53 of Title 59.1 of the Code of Virginia and in force since 1 January 2023. It gives Virginia residents rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and significant profiling. It also sets duties for controllers and processors, including privacy notices, security and data protection assessments.

The VCDPA applies to businesses that operate in Virginia or target products or services at Virginia residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data. State bodies, nonprofits, higher education institutions, GLBA financial institutions and HIPAA covered entities are exempt.

The Virginia Attorney General can seek an injunction and civil penalties of up to $7,500 for each violation, plus reasonable investigation and legal expenses. Before taking action, the Attorney General must give 30 days' written notice, and no action follows if the business cures the violation and confirms this in writing. The law gives consumers no private right of action, so enforcement rests solely with the Attorney General.

Consumers have five rights: to confirm processing and access their personal data, to correct inaccuracies, to delete data, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data and profiling with legal or similarly significant effects. Controllers must respond within 45 days, extendable once by a further 45 days, and must offer an appeal process when they refuse a request.

Controllers must conduct and document a data protection assessment for targeted advertising, sale of personal data, risky profiling, processing of sensitive data and any other processing with a heightened risk of harm. Since 2024 amendments, online services directed at known children also need an assessment. Assessments must weigh benefits against risks to consumers, and the Attorney General can demand them during an investigation.

The VCDPA borrows much of its structure from GDPR, including controllers and processors, data protection assessments and similar access, correction, deletion and portability rights. It differs in key ways: it applies only above consumer volume thresholds, excludes employee and business-to-business data, relies on opt-out rather than a lawful basis for most processing, and requires opt-in consent only for sensitive data.

Partly. The VCDPA requires reasonable administrative, technical and physical security practices, and an ISO 27001 or SOC 2 programme is strong evidence of that. Neither covers the privacy obligations, such as consumer rights handling, privacy notices, opt-outs, sensitive data consent and data protection assessments. Mapping existing controls to the VCDPA shows which security work you can reuse and which privacy gaps remain.

The VCDPA is mapped in OneClickComply's control library and is available on request rather than as a standard live framework today. Once enabled, the same controls you use for ISO 27001, SOC 2 or GDPR are mapped to VCDPA sections, so evidence you already collect counts towards it. Our audit team can advise on the privacy requirements that need separate work.