← All US breach laws·VA

Virginia data breach notification law

Virginia's data breach notification requirements under Va. Code §18.2-186.6 (also §32.1-127.1:05 for medical info). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Va. Code §18.2-186.6
Enforcer
Virginia Attorney General — Consumer Protection
AG notification
Required
Private right of action
Yes — residents can sue

Notification deadlines

Notify affected residents
Without unreasonable delay
Notify the state regulator
Yes — written notice to the AG without unreasonable delay
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when the breach has caused or is reasonably believed to have caused identity theft or other fraud
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Virginia law

First name/initial + last name with SSN, DL/state ID, financial account + access code, taxpayer ID; medical info covered separately under §32.1-127.1:05

Penalties and enforcement

Up to $150,000 per breach under Virginia Consumer Protection Act; private right of action for actual damages
Enforced by: Virginia Attorney General — Consumer Protection. Official regulator page →

Common pitfalls

⚠ Medical info breaches require a SEPARATE notification under the health-info statute — easy to miss for healthcare-adjacent SaaS

Frequently asked questions

How long do I have to notify Virginia residents after a data breach?
Without unreasonable delay
Do I have to notify the Virginia Attorney General?
Yes — written notice to the AG without unreasonable delay
Does Virginia require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Virginia's breach notification requirement?
Yes — Virginia has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Virginia residents sue me directly for a data breach?
Yes — Virginia allows a private right of action. Affected residents may sue for actual damages and, in some cases, statutory damages or attorneys' fees. Class actions are common.
What counts as 'personal information' under Virginia law?
First name/initial + last name with SSN, DL/state ID, financial account + access code, taxpayer ID; medical info covered separately under §32.1-127.1:05
What are the penalties for failing to comply with Virginia's breach notification law?
Up to $150,000 per breach under Virginia Consumer Protection Act; private right of action for actual damages

Related state breach laws

Utah (UT)
Utah Code §§13-44-101 to 13-44-301
Vermont (VT)
9 V.S.A. §§2430
Washington (WA)
Wash. Rev. Code §19.255.010
West Virginia (WV)
W. Va. Code §§46A-2A-101 to 46A-2A-105

Pre-empt the Virginia breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Virginia's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit