Who must comply with the Virginia Consumer Data Protection Act (“CDPA”)?
The CDPA applies to entities that conduct business in Virginia or target Virginia residents during a calendar year that either:
-
Control or process personal data of at least 100,000 Virginia residents; or
-
Control or process personal data of at least 25,000 Virginia consumers and derive over 50% of gross revenue from the sale of personal data.
The statute is unclear as to whether the revenue threshold applies to Virginia residents only and it does not have a minimum revenue threshold for the law to apply.
For more information, see here: https://law.lis.virginia.gov/vacode/title59.1/chapter53/
These materials were obtained directly from the State Legislative websites and are posted here for your review and reference only. No Claim to Original State Government Works. This may not be the most recent version. The State may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.