Digital Policy Alert logo

United States of America: Implemented Virginia Consumer Data Protection Act

Go to policy change overview
Share

Compare with different regulatory event:

Description

Implemented Virginia Consumer Data Protection Act

On 1 January 2023, the Consumer Data Protection Act (VCDPA) becomes effective after its adoption on 2 March 2021. The bill establishes new requirements for personal data processing and security and applies to entities that produce or advertise their services to the residents of Virginia. Among others, the Act foresees the implementation of system security standards in order to mitigate cybersecurity risks.

Original source

Scope

Policy Area
Data governance
Policy Instrument
Cybersecurity regulation
Regulated Economic Activity
cross-cutting
Implementation Level
subnational
Government Branch
legislature
Government Body
parliament

Complete timeline of this policy change

Hide details
2021-01-13
under deliberation

A comprehensive digital privacy bill (Virginia Consumer Data Protection Act) is introduced to parli…

2021-02-19
adopted

The Virginia Consumer Data Protection Act is adopted by both chambers of the state parliament. The …

2021-03-02
adopted

The governor signed the Virginia Consumer Data Protection Act into law. The bill establishes new re…

2023-01-01
adopted

On 1 January 2023, the Consumer Data Protection Act (VCDPA) becomes effective after its adoption on…

Key regulatory dimensions

Regulated subjects

The businesses, government agencies or individuals affected by this policy or regulatory change.
producer / supplier
1
Type Private organisation
Economic activity cross-cutting
Category All

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.
personal data (all forms): data collection
Regulatory tool
Preventive security requirement
Responsive security requirement
Sanctions
Fine
Regulated subjects
1
personal data (all forms): storage (any form)
Regulatory tool
Preventive security requirement
Responsive security requirement
Sanctions
Fine
Regulated subjects
1
personal data (all forms): sale
Regulatory tool
Preventive security requirement
Responsive security requirement
Sanctions
Fine
Regulated subjects
1
personal data (all forms): transmission
Regulatory tool
Preventive security requirement
Responsive security requirement
Sanctions
Fine
Regulated subjects
1
personal data (all forms): data processing
Regulatory tool
Preventive security requirement
Responsive security requirement
Sanctions
Fine
Regulated subjects
1
advertisement: behavioural targeting: marketing (any form)
Regulatory tool
Preventive security requirement
Responsive security requirement
Sanctions
Fine
Regulated subjects
1

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.

personal data (all forms): data collection

personal data (all forms): storage (any form)

personal data (all forms): sale

personal data (all forms): transmission

personal data (all forms): data processing

advertisement: behavioural targeting: marketing (any form)