What is the VCDPA?

The Virginia Consumer Data Protection Act (VCDPA) (opens in a new tab) is a comprehensive consumer privacy law that protects the data privacy of all Virginia residents. CDPA went into effect on January 1, 2023, following California Privacy Rights Act (CPRA). Unlike in California, where the enforcement date is July 1, 2023, CDPA’s enforcement date was on the first day of the year.

Ensure your business is prepared for VCDPA compliance by following the steps in this guide.

Who is Subject to VCDPA? Permalink for this section

VCDPA applies to business (“controllers“) that operate within Virginia or targets its products and services to Virginia residents and either:

• Control or process personal data of at least 100,000 consumers, or
• Control or process the personal data of at least 25,000 consumers and generate over 50% of gross revenue from the sale of personal data.

[VCDPA - Virginia Consumer Data Protection Act](/content/docs/regulations/vcdpa "VCDPA - Virginia Consumer Data Protection Act"/index.html) [What are requirements of the VCDPA?](/content/docs/regulations/vcdpa/what_reqs_vcdpa "What are requirements of the VCDPA?"/index.html)