Breach of personal information notification
VA breach notification
Breach notification
Requires anyone who owns or licenses computerized personal information of Virginia residents to notify the Attorney General and affected residents without unreasonable delay after a breach that causes or is reasonably believed to cause identity theft or other fraud. Personal information is name plus SSN, driver's license or state ID, financial account or card number with access code, passport number, or military ID number, when unencrypted and unredacted.
- Where
- Virginia
- Citation
- Va. Code § 18.2-186.6
- Status
- In force
- In force since
- 2008-07-01
- Last amended
- 2020-07-01
- Enforced by
- Virginia Attorney General; primary state regulator for state-chartered or licensed financial institutions (18.2-186.6(I)-(J))
- People can sue
- Limited
- Penalties
- Attorney General civil penalty up to $150,000 per breach or series of similar breaches discovered in one investigation; individuals may still recover direct economic damages (18.2-186.6(I)).
- Applies to
- Individuals and entities (including governments and nonprofits) that own, license, or maintain computerized data with personal information of Virginia residents (18.2-186.6(A))
- Employers and payroll service providers holding income-tax-withholding data (18.2-186.6(M))
- Not applicable to entities regulated by the SCC Bureau of Insurance (18.2-186.6(K)); GLBA-compliant and regulator-compliant entities are deemed compliant (G)-(H)
Breach duties
- Notify the Office of the Attorney General and affected Virginia residents without unreasonable delay after discovering a breach that causes or is reasonably believed to cause identity theft or other fraud; delay allowed for scoping and at law-enforcement request.Va. Code § 18.2-186.6(B)
- Notice must describe the incident, the type of information involved, steps taken to protect it, a contact telephone number if one exists, and advice to review account statements and credit reports.Va. Code § 18.2-186.6(A) ('Notice')
- Notify if encrypted data is acquired in unencrypted form or the breach involves someone with the encryption key.Va. Code § 18.2-186.6(C)
- A third party maintaining data it does not own must notify the owner or licensee without unreasonable delay.Va. Code § 18.2-186.6(D)
- If more than 1,000 persons are notified at once, also notify the Attorney General and nationwide consumer reporting agencies of the timing, distribution, and content of the notice.Va. Code § 18.2-186.6(E) · Only if: >1,000 persons notified
- Employers and payroll providers must notify the Attorney General of unauthorized acquisition of taxpayer ID numbers combined with income tax withheld, giving the employer's name and FEIN.Va. Code § 18.2-186.6(M) · Only if: Employer or payroll service provider
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Effective date inferred from Virginia's default July 1 effective date for regular-session acts (chapters listed in the Code history note); the enacting bill page was not checked. History: 2008, cc. 566, 801; 2017, cc. 419, 427; 2019, c. 484; 2020, c. 264.
Research reference, not legal advice.