Key Aspects of the Virginia CDPA

Personal Data

Defines “personal data” as “any information that is linked or reasonably linkable to an identified or identifiable natural person”

Consumer Rights

Provides consumers with rights to confirmation of processing and access to personal data, correction of personal data, deletion , portability  and opt-out of processing for targeted ads, sale of personal data, or  profiling  

Data Protection Assessments

Requires controllers to carry out data protection assessments of processing activities that involve personal data used for targeted advertising, the sale of personal data, profiling, the use of sensitive data, and the use of any data that presents a heightened risk of harm to consumers

data redaction


Defines “consent” as “a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer”


Applies to organizations that conduct business in Virginia or produce products or services targeted at Virginia residents and that control or process personal data of at least 100k consumers annually, or  control or process personal data of at least 25K consumers and get over 50% of gross revenue from the sale of personal information 



Allows Attorney General to enforce the law, as there is no provision for a private right of action

CDPA Consumer Rights

The CDPA Grants Individuals the Following Rights


The right to confirm whether the controller is processing personal information


The right to access personal information


The right to delete personal information


The right to correct inaccurate personal information


The right to request personal information in a readily usable format


The right to opt out of the processing of personal data for purposes of targeted advertising


The right to opt out of the sale of personal data


The right to opt out of profiling that results in legal or significant effects concerning the consumer

How OneTrust Helps with the CDPA

CDPA Research & Readiness

Become a CDPA expert with research portals and prepare to report to your board with maturity & planning and program benchmarking tools.

CDPA Privacy Management Software

Operationalize and automate CDPA requirements across consumer rights, and privacy governance operations.

CDPA Professional Services

Get help planning and implementing the CDPA with a CDPA readiness check up, and our implementation and validation services.

Assess 3rd Country

CDPA Global User Community

Collaborate with industry peers on best practices on implementing the CDPA at free PrivacyConnect workshops, and in customer advisory boards.

Onetrust All Rights Reserved