Virginia Consumer Data Protection Act (VCDPA) Compliance: Answer Data Subject Requests on the 45-Day Clock
The Virginia Consumer Data Protection Act gives Virginia residents the right to access, correct, delete, and port the personal data you hold, and to opt out of its sale, targeted advertising, and profiling. A verified request starts a 45-day clock, and the data usually sits across your CRM, warehouse, billing, and support tools. Obtainer finds where a person's data lives across those systems, compiles one reviewable manifest, drafts the response, and tracks the deadline.
found
scanned
Assembling the cover letter from the template...
Helps you comply, not legal advice
In short
The Virginia Consumer Data Protection Act (VCDPA) took effect on January 1, 2023, and was the second comprehensive US state privacy law after California. It applies to any entity that conducts business in Virginia or targets Virginia residents and, in a calendar year, either controls or processes the personal data of at least 100,000 consumers, or controls or processes the data of at least 25,000 consumers while deriving more than 50 percent of gross revenue from the sale of personal data. Virginia consumers can confirm whether you process their data and access it, correct inaccuracies, delete it, and obtain a portable copy, and can opt out of the sale of their data, targeted advertising, and profiling that produces legal or similarly significant effects. You generally must respond within 45 days, extendable once by another 45 days with notice. Unlike Colorado, Connecticut, and California, the VCDPA does not require you to honor a universal opt-out signal such as Global Privacy Control, though many companies honor it anyway to stay consistent across states. Enforcement rests solely with the Virginia Attorney General, with civil penalties of up to $7,500 per violation plus attorney fees and costs, and a 30-day cure period that is permanent, with no sunset. There is no private right of action. Obtainer handles the operational side of a VCDPA request: it intakes the request, discovers where the person's data lives across your systems, compiles a source-system manifest, drafts a deadline-safe response, and tracks the 45-day clock. Nothing is disclosed automatically; a human reviews, redacts, and approves. Obtainer helps you comply. It is not legal advice, so whether the VCDPA applies to your business and how you handle exemptions stay with your team. Self-serve from $49/mo.
Why it fits
Virginia businesses, plus out-of-state SaaS, ecommerce, adtech, and B2B firms that target Virginia residents at the VCDPA thresholds, and want the discovery, drafting, and 45-day deadline tracking for a data subject request handled in one place without an enterprise governance suite.
Know if the thresholds pull you in
The VCDPA uses OR logic: you are covered if you process the personal data of 100,000 or more Virginia consumers in a year, or if you process the data of 25,000 or more while deriving more than half your gross revenue from selling data. There is no flat revenue floor. A mid-market ecommerce or adtech business serving Virginia can cross the 100,000 line without a dedicated compliance team.
45 days to respond, five rights to honor
Virginia residents can access, correct, delete, and port their data, and opt out of sale, targeted advertising, and profiling. You have 45 days from a verified request, extendable once by another 45 days with notice. Obtainer starts the countdown when the request arrives, finds the data across your stack, and drafts the reply so the deadline stays workable.
Discovery across your stack, priced for you
A single consumer's data sits in your production database, warehouse, Stripe, help desk, and email. Obtainer surfaces where it lives and compiles one manifest instead of leaving an engineer to hunt it down. Self-serve from $49/mo, with no five-figure floor to clear before you can answer your first request.
More use cases
Related features
Questions
Common questions about this
Who must comply with the Virginia Consumer Data Protection Act?
Any entity that conducts business in Virginia or targets Virginia residents and, in a calendar year, either processes the personal data of at least 100,000 consumers, or processes the data of at least 25,000 consumers while deriving more than 50 percent of gross revenue from selling personal data. There is no flat revenue threshold. Nonprofits, higher-education institutions, and HIPAA and GLBA regulated data carry exemptions.
When did the Virginia Consumer Data Protection Act take effect?
The VCDPA took effect on January 1, 2023, making Virginia the second US state, after California, to enact a comprehensive consumer privacy law. Later amendments added protections for consumer health data and for the data of known minors, but the core access, deletion, correction, portability, and opt-out rights have applied since the 2023 effective date.
What are the penalties for violating the VCDPA?
The Virginia Attorney General has exclusive authority to enforce the VCDPA and can seek civil penalties of up to $7,500 per violation, plus reasonable attorney fees and costs. Businesses receive written notice and a 30-day period to cure the alleged violation, and unlike several other states that cure period is permanent, with no sunset date. There is no private right of action, so consumers cannot sue directly.
Does the VCDPA require honoring Global Privacy Control?
No. The VCDPA does not require controllers to recognize a universal opt-out mechanism such as Global Privacy Control, which makes Virginia an outlier among the newer state laws. Consumers exercise their opt-out rights through your request process instead. Many multi-state companies still honor GPC voluntarily because Colorado, Connecticut, California, and others do require it, and one consistent process is simpler than several.
Run a data subject access request end to end
Obtainer finds where a person's data lives across your systems, compiles it into one manifest, drafts the deadline-safe response, and tracks the GDPR and CCPA clock. You review, redact, and approve what gets disclosed. Helps you comply; not legal advice.