Virginia Data Breach Notification Law

What the Virginia data breach notification law covers

Va. Code § 18.2-186.6 has a two-track notice duty: the Office of the Attorney General and every affected resident, both without unreasonable delay ¹.

Virginia's list adds passport numbers and military ID numbers to the familiar name-plus-SSN, license and card entries ¹.

Outside firms that keep records for a client, such as a cloud backup service, owe that client notice of a breach ¹. Medical information has its own breach statute in Virginia, Va. Code § 32.1-127.1:05, separate from this one ¹.

Attorney General notice for every Virginia breach

There is no floor. One Virginian's letter means one filing with the Office of the Attorney General ¹. Owners used to headcount triggers in other states are the ones who miss it.

Bigger incidents add a second report. Past 1,000 persons notified at one time, the Attorney General and the nationwide credit bureaus must each learn how and when the letters went and what they said ¹.

Payroll adds a third duty. When an employee's taxpayer identification number leaks together with the income tax withheld, the employer or its payroll service provider must tell the Attorney General ¹. The usual cause is a W-2 phishing email that impersonates an executive and asks for every employee's tax form. The email safeguards that block it are in security steps for a small office.

Timing: without unreasonable delay

Virginia never names a number of days; both the AG and residents are owed notice without unreasonable delay ¹.

A real investigation fits inside that phrase. A slow vendor or a board that meets next month does not. When the list includes Marylanders or North Carolinians, those states' rules often set the pace: Maryland and North Carolina each have their own, and the deadline for every state sits in one chart. Work to the earliest one and mail Virginia's letters that day too.

When Virginia does not require notice

Two routes keep an incident out of the statute.

• No reasonable belief of fraud. A breach counts only when the business reasonably believes it has caused, or will cause, identity theft or other fraud to a Virginia resident. Virginia does not require that a no-notice decision be written down ¹.
• Encryption. Encrypted or redacted data is exempt unless it was acquired in unencrypted form or the breach involves a person with access to the encryption key ¹.

Here, deciding not to notify residents also means saying nothing to the Attorney General, who would otherwise hear of every qualifying breach. Reach that call with a lawyer once forensics is done, and keep a private memo of the reasoning. Encrypting laptop drives and backups is the low-cost way to keep a missing device from turning into a filing.

Penalties and the question of private lawsuits

In a suit by the Attorney General, the civil penalty reaches $150,000 per breach, or per series of similar breaches found in a single investigation ¹.

Customer lawsuits sit in a gray zone. The text preserves an individual's recovery of direct economic damages without clearly granting a cause of action ¹, and published charts disagree about it. If a customer threatens to sue, get a lawyer's read rather than relying on either chart.

First steps and other Virginia rules

While the attack is live, a policyholder's first call is the carrier's claim line, its second is an online FBI report at ic3.gov, and nobody reimages a machine before the evidence is copied ³⁶⁴. IC3 counted 25,314 complaints from Virginians in 2025, with about $476 million lost ⁵.

Then:

1. Contain it with an outside response team, or your usual IT support for a minor event.
2. Read the policy before you retain a lawyer, because carriers often insist on their own panel; cyber coverage conditions explains the common ones.
3. Group the affected people by state and pull out any employee tax records for the payroll filing.
4. Mail the AG's copy with the resident letters, since every qualifying breach needs one.

Larger data handlers also face the Virginia Consumer Data Protection Act, which reaches companies that control or process personal data of at least 100,000 Virginia consumers a year, or 25,000 when over 50% of gross revenue comes from selling personal data ². Clinics have the federal layer in HIPAA's breach notice rule. Richmond and Virginia Beach owners can compare local support costs on those city pages.

This reading of § 18.2-186.6 was last checked on October 13, 2026. Before any decision not to notify, get legal advice from a Virginia lawyer on what you owe.