West Virginia Data Breach Notification Law

The West Virginia data breach notification law: short and unchanged

The statute, W. Va. Code §§ 46A-2A-101 to 46A-2A-105, is short and has stayed put. The bill history on the official code site lists only 2008 S.B. 340, and our check found no amendment from 2024 to 2026 ¹. What it lacks matters as much as what it says: no fixed deadline, no state agency notice and no extra data types.

Notice to residents is required when the business reasonably believes the breach has caused or will cause identity theft or other fraud to a West Virginia resident ¹. Nothing in the law makes you write down a no-notice decision. Hold on to the forensic report anyway, since the Attorney General may want to see why letters never went out.

Only the familiar trio of identifiers is protected here, each paired with a name: Social Security number, driver's license number, or a financial account or card number together with its access code. Medical records and online logins fall outside the definition ¹.

Outside firms holding records on a client's behalf, such as a payroll processor, owe that client a heads-up as soon as practicable ¹.

Timing, the credit bureaus and other states

The clock here is a standard, not a count: without unreasonable delay, with time allowed for a police hold and for the work of scoping the incident and getting systems back ¹. No state office receives a filing ¹.

Once the letters pass 1,000 recipients, the consumer reporting agencies must also be told, an obligation that skips businesses subject to GLBA Title V ¹.

Customers across the border do not inherit that light touch. One affected Virginia resident means a notice to that state's Attorney General, whatever the size of the breach, and Pennsylvania applies thresholds of its own. Line up every state involved with the side-by-side state comparison.

Encryption and penalties

Encrypted or redacted data is exempt unless it was acquired in unencrypted form or the breach involves a person with access to the encryption key ¹. A stolen laptop with full-disk encryption usually stays a hardware loss, not a notice event. Make an inventory now of which machines and backup drives are encrypted and who holds the keys.

Skipping notice counts as an unfair or deceptive act, and the Attorney General is the only enforcer ². A civil penalty applies only to a course of repeated and willful violations and is capped at $150,000 per breach or series of similar breaches ². Licensed financial institutions answer to their primary federal or state regulator instead ¹². Consumers have no private lawsuit under this section ².

The first week after a West Virginia breach

While the intruder may still be inside, a covered business phones its carrier's claims line, logs a complaint with the FBI through ic3.gov, and leaves servers and laptops as they are so the evidence survives ³⁵⁴.

1. Bring in an incident response team, or your regular IT support if the event is small, to shut the attacker out and save the logs.
2. Read the policy for panel lawyers and forensic vendors before hiring anyone; what cyber insurers ask of small firms covers the usual conditions.
3. Pin down which records were exposed and sort the people by home state.
4. Mail the West Virginia letters promptly, and alert the credit bureaus if the count tops 1,000.

A medical or dental office also answers to HIPAA's federal notice rule. Once things are calm, record the lessons in your WISP.

We read this summary against Chapter 46A on October 13, 2026. It explains the statute in plain terms and is not legal advice; a West Virginia lawyer should confirm what it means for you.