The Virginia Consumer Data Protection Act (VCDPA) comes into force today, making Virginia the second US state, after California, with a comprehensive consumer privacy law in effect.
Key points
- Consumers gain rights to access, correct, delete and port their data, and to opt out of targeted advertising, sale and profiling.
- Consent is required to process sensitive data.
- Controllers must carry out data protection assessments for high-risk processing.
- Contracts between controllers and processors must include set terms.
The VCDPA became a model for many later state laws. UK organisations handling US consumer data should build a single, framework-based approach to meeting multiple state requirements.
Source: Virginia Consumer Data Protection Act, Code of Virginia ch. 53 (Virginia Law)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
