Managed IT and Cybersecurity in Virginia

Va. Code § 18.2-186.6. Notice to affected people: without unreasonable delay.

Virginia's breach notification law is Va. Code § 18.2-186.6. When a business finds that personal information of Virginia residents was accessed or acquired by an unauthorized person, it must give notice without unreasonable delay. The statute sets no fixed number of days.

The notice goes to the Office of the Attorney General and to each affected resident. When more than 1,000 people are notified at one time, the business must also notify the nationwide consumer reporting agencies.

Virginia also has the Consumer Data Protection Act, Va. Code § 59.1-575 and following. It applies to businesses that control or process the personal data of at least 100,000 Virginia consumers in a year, or at least 25,000 consumers while earning over 50 percent of gross revenue from selling personal data. Data used in the context of an employee or contractor role is exempt. Most small businesses fall under these thresholds, which is worth confirming rather than assuming.

This is a plain language summary for orientation, reviewed in October 2026. It is not legal advice. Ask counsel about your own facts.