Virginia Consumer Data Protection Act (VCDPA)
The VCDPA provides Virginia residents with consumer data protection rights including deletion, correction, and access to personal data.
Your VCDPA Rights
Right to Delete
Request deletion of personal data provided by or obtained about you, with limited exceptions
Right to Access
Confirm whether a controller is processing your personal data and access such data
Right to Correct
Correct inaccuracies in your personal data, taking into account the nature and purposes of processing
Right to Opt-Out
Opt-out of targeted advertising, sale of personal data, or profiling for decisions with legal effects
VCDPA Business Requirements
Authentication Required
Controllers must authenticate consumer requests using reasonable methods
45-Day Response
Controllers must respond within 45 days, with possible 45-day extension
No Fees Generally
Controllers cannot charge fees unless requests are excessive or manifestly unfounded
Limited Exceptions
Some data retention required for legal compliance, security, or research purposes
Who Must Comply with VCDPA
Covered Controllers
The VCDPA applies to entities that:
- Control or process personal data of at least 100,000 Virginia consumers annually
- Control or process personal data of at least 25,000 Virginia consumers annually AND derive over 50% of gross revenue from selling personal data
- Conduct business in Virginia or provide products/services targeted to Virginia residents
Exemptions include: Small businesses under thresholds, non-profits, higher education institutions, and government entities.
VCDPA vs CCPA Key Differences
Broader Exemptions
VCDPA has more exemptions for employee data, B2B communications, and pseudonymized data
No Private Right
Unlike CCPA, VCDPA has no private right of action - only Attorney General enforcement
Consent for Sensitive Data
VCDPA requires explicit consent for processing sensitive personal data
Right to Appeal
Consumers have the right to appeal controller decisions regarding their requests
Exercise Your VCDPA Rights
Important: We make best efforts to remove your data, but nothing is guaranteed. Results depend on individual company compliance with VCDPA requirements.
Ready to exercise your Virginia privacy rights? Contact us for professional assistance.
Email support@sagebrush.services for VCDPA consultationOur team works with Neon Law® attorneys who understand Virginia privacy law and can help navigate the VCDPA deletion process effectively.