Data Breach Notice to Residents and State Authorities in Virginia
At a glance
| Covered entity and service provider | Owner/licensee: resident and AG notice; nonowner maintainer: owner/licensee notice without unreasonable delay (§ 18.2-186.6(B), (D)) |
|---|---|
| Breach and covered information | Access AND acquisition of computerized name plus SSN, ID, financial credentials, passport, or military ID; encrypted data with key can count (§ 18.2-186.6(A)-(C)) |
| Risk screen or notice exception | Identity theft/other fraud caused or reasonably believed likely; employee good-faith, no-misuse exclusion; encryption/redaction limits (§ 18.2-186.6(A)-(C)) |
| Individuals who receive notice | Affected Virginia residents whose unencrypted/unredacted information was or is reasonably believed accessed and acquired (§ 18.2-186.6(B)-(C)) |
| Individual notice deadline and clock | Without unreasonable delay after discovery or notification; reasonable scope/restoration delay; no numbered outside limit (§ 18.2-186.6(B)) |
| Regulator threshold and deadline | AG notice with each qualifying resident breach, without unreasonable delay; over 1,000 notices also report timing, distribution and content (§ 18.2-186.6(B), (E)) |
| Consumer-reporting-agency notice | More than 1,000 people notified at once: all nationwide agencies, without unreasonable delay, with timing, distribution and content (§ 18.2-186.6(E)) |
| Individual delivery and content | Mail, phone or electronic; incident, data type, protective acts, help number if any, and vigilance/credit-report advice (§ 18.2-186.6(A)) |
| Substitute notice conditions and channels | Direct cost over $50,000, over 100,000 VA residents, or insufficient contact/consent: available email, website if maintained, AND statewide media (§ 18.2-186.6(A)) |
| Delays and alternate compliance | Scope/restoration or agency-advised investigation/security delay; consistent own-policy, GLBA, or primary-regulator procedures may satisfy (§ 18.2-186.6(B), (F)-(H)) |
Requirements one by one
Covered information and risk
Va. Code § 18.2-186.6(A)-(H) governs the general notice route. Subsection (A) requires unauthorized access and acquisition of unencrypted and unredacted computerized data in a database about multiple individuals, plus resulting or reasonably anticipated identity theft or other fraud to a Virginia resident. The covered name-and-data combinations include Social Security, driver or state ID, financial account credentials, passport, and military ID numbers. Information obtained lawfully from public sources is excluded. Good-faith employee or agent acquisition for the entity's purposes is excluded if the information is not misused or further disclosed without authorization. Subsection (C) also addresses encrypted information accessed in unencrypted form or a breach involving access to the encryption key and the specified fraud risk.
Who receives notice
Under § 18.2-186.6(B), the owner or licensee gives notice to affected Virginia residents and the Office of the Attorney General without unreasonable delay after discovery or notice of the qualifying breach. There is no 1,000-person floor for that initial AG notice. A nonowner maintainer informs the owner or licensee without unreasonable delay after discovery under subsection (D). If more than 1,000 people receive notice at one time, subsection (E) adds nationwide consumer-reporting-agency notice and calls for the AG and agencies to receive the timing, distribution, and content of resident notice.
Delivery and content
Section 18.2-186.6(A) allows postal, telephone, or electronic notice. It requires a general incident description, the type of data accessed and acquired, general protective acts, a telephone assistance number if one exists, and advice to watch account statements and free credit reports. Substitute notice requires a direct-notice cost over $50,000, an affected class over 100,000 Virginia residents, or insufficient contact information or consent. The substitute combines available email, a website post if the entity maintains a site, and major statewide media.
What trips people up
A delay has defined limits. Section 18.2-186.6(B) allows reasonable time to determine scope and restore integrity. For an investigation or security delay, the entity notifies law enforcement and the agency must determine and advise that notice would impede the investigation or jeopardize national or homeland security. Notice resumes without unreasonable delay when the agency clears it.
Payroll records have a separate AG route. Va. Code § 18.2-186.6(M) requires an employer or payroll provider handling the stated employee income-tax withholding data to notify the AG if its special data-and-fraud conditions are met. The report includes the affected employer's name and federal employer identification number; the AG then informs the Department of Taxation. That subsection does not extend to the employer's customers.
Common questions
Can an internal notice policy satisfy the statute? Under § 18.2-186.6(F), an entity with consistent timing procedures in its privacy or security policy complies if it follows them when notifying residents. Subsections (G) and (H) also recognize qualifying financial-sector or primary-regulator procedures.
Does encryption always avoid notice? No. Section 18.2-186.6(C) addresses information accessed in unencrypted form and breaches involving access to the encryption key with the stated fraud risk.
Statutes and sources
- Va. Code § 18.2-186.6 — covered data, resident and AG notice, methods, content, delays, and payroll route. https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/ (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does Virginia law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Virginia law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace