Virginia Consumer Data Protection Act (“VCDPA”) was signed into law on March 2, 2021. The new law means that some Virginia Businesses will need to give consumers the ability to access and control personal data that the business collects about them. Virginia consumers will have the right to submit a request to access, correct, and delete personal data that they provided or that was obtained about them.

This means that if you collect data for a mailing list, or for shipping data, just to name a few, then this means you.

This law also gives the consumer the right to obtain a copy of data the consumer has previously provided, in a readable and usable format “to the extent technically feasible”.

This law will allow the consumer to opt out of targeted advertisements and opt out of the sale of their personal data. The business must also respond to requests within 45 days of notice.

The good news is that the new law has a few limitations that may help you as a business owner. The law only applies to Virginians’ personal data “in an individual or household context.”. What counts as personal data is also limited under the new law. This means that information lawfully made available through government records is exempted, and “that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information unless the consumer has restricted the information to a specific audience.”

Consumers also have no right to protect data that they post publicly on Social Media sites like Facebook.