Virginia's Consumer Data Protection Act: State privacy law arrived in 2021

For most of the internet era, comprehensive privacy law in the United States was a California story. The California Consumer Privacy Act stood nearly alone, and organizations that did not operate heavily in California could largely ignore it. That changed in March 2021, when Virginia's governor signed the Consumer Data Protection Act, making Virginia the second state to enact a comprehensive privacy law. The signal was unmistakable: data protection was becoming a national, state-by-state reality, and organizations everywhere needed to start paying attention. Here is what the CDPA requires and where reasonable security and training fit in.

What the CDPA actually covers

The Virginia Consumer Data Protection Act applies to businesses that control or process the personal data of Virginia residents, with thresholds based on the volume of data handled and revenue. It grants consumers a familiar set of rights: the right to access, correct, delete, and obtain a copy of their personal data, and the right to opt out of the sale of that data and of targeted advertising and profiling. These rights mirror the CCPA in many respects, but the CDPA also introduced a stronger emphasis on data minimization and purpose limitation, concepts drawn more from the European General Data Protection Regulation than from California's model.

The reasonable security requirement

A quieter but important provision of the CDPA is its data security obligation. The law requires controllers to establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data at issue. The word reasonable is doing significant work, but the practical meaning is by now well established: organizations must implement controls that reflect the sensitivity of the data they hold, including access controls, encryption where appropriate, and a workforce that understands how to protect it. This is not a prescriptive checklist, but it is also not nothing.

How training satisfies reasonable security

Security awareness training sits at the center of the reasonable security analysis. Regulators consistently treat a trained workforce as a foundational safeguard, because most data incidents begin with human error. A business that can demonstrate it trains employees on data handling, phishing, and incident reporting is in a far stronger position to argue its security was reasonable. Conversely, a business that cannot show any training has a hard time claiming it took the steps the law expects. Under the CDPA, as under other privacy laws, documented training is one of the clearest pieces of evidence that reasonable security actually exists.

The operational duties that follow the rights

Beyond security, the CDPA imposes operational obligations that fail when employees do not know how to execute them. Honoring a consumer's request to access or delete their data requires a workforce that understands what personal data the business holds, where it lives, and how to respond. Data minimization requires employees to think before collecting more than they need. These are procedural duties, and they depend on people. Training that covers these operational responsibilities, not just security awareness, is what turns the law's requirements into working processes.

Why Virginia mattered beyond Virginia

The CDPA's significance was less about Virginia's market than about the precedent it set. It confirmed that the CCPA was not an anomaly but the start of a trend. In the months that followed, Colorado, Connecticut, and Utah passed their own comprehensive privacy laws, and more states joined the queue. Organizations that had treated privacy compliance as a California-only obligation suddenly faced a patchwork. The lesson was clear: building a single, documented privacy and security program that met the highest common denominator was far more efficient than maintaining a separate program for each state.

What to do about it

The practical response to the CDPA, and to the state privacy laws that followed, was to stop treating each law as a separate project. Organizations should: inventory the personal data they hold and how it is processed; implement a documented reasonable security program, including training; establish processes to honor consumer rights requests; and keep records that demonstrate compliance. A consistent training program, covering both security awareness and privacy obligations, delivered to all employees with clean documentation, is exactly the kind of foundation that scales across a growing patchwork of state laws.