Virginia’s breach notification statute, Va. Code § 18.2-186.6, applies to any individual or entity that owns or licenses computerized data containing personal information of Virginia residents. A four-person law office, a medical practice, a nonprofit with a donor database, and a contractor with employee records are all covered by the same section.
What the statute requires is specific enough to build a process around, and most of the work happens before an incident rather than during one.
When a breach triggers the statute
The definition has three parts, and all three have to be present. The data must be unencrypted and unredacted, it must be maintained as part of a database of personal information about multiple individuals, and the unauthorized access and acquisition must cause, or be reasonably believed to cause, identity theft or other fraud to a Virginia resident.
The third part is a materiality test, not a formality. An incident that cannot plausibly lead to identity theft or fraud is outside the section, and the reasoning behind that conclusion belongs in writing.
What counts as personal information
Personal information is a first name or first initial and last name linked to one or more of these elements:
- A Social Security number.
- A driver’s license number or a state identification card number.
- A financial account number, or a credit or debit card number, together with the security code, access code, or password that permits access to the account.
- A passport number.
- A military identification number.
The statute also defines redaction by degree: data is redacted when no more than five digits of a Social Security number are accessible, or when only the last four digits of a driver’s license, state identification, or account number are accessible. Information lawfully available from government records is excluded.
Encryption and the key
Encrypted data falls outside the definition, with an exception that catches organizations regularly. Disclosure is required if encrypted information is accessed and acquired in unencrypted form, or if the person who breached the system had access to the encryption key and the entity reasonably believes the incident will cause identity theft or fraud.
Backups encrypted at rest, with keys stored on the same server that was compromised, satisfy the letter of the encryption control and none of its purpose.
Who gets notice
The Office of the Attorney General and each affected Virginia resident, both without unreasonable delay after discovery.
Separately, if notice goes to more than one thousand people at one time, the entity must notify the Attorney General and every nationwide consumer reporting agency of the timing, distribution, and content of the notice, also without unreasonable delay. Read the two sentences together and the Attorney General is a recipient in every case, not only the large ones.
Where the cost of notice would exceed $50,000, the affected class exceeds 100,000 residents, or the entity lacks sufficient contact information or consent, substitute notice is allowed: email to those addresses it holds, a conspicuous posting on its website, and notice to major statewide media. All three parts, not whichever is convenient.
What the notice must contain
The statute defines “notice” partly by content, and a letter that omits an element is not the notice the section describes. It must include:
- A description of the incident in general terms.
- The type of personal information subject to the unauthorized access and acquisition.
- The general acts the entity took to protect the information from further unauthorized access.
- A telephone number the recipient can call for further information and assistance, if one exists.
- Advice to remain vigilant by reviewing account statements and monitoring free credit reports.
Item four is where organizations without a staffed phone line get stuck. If the number rings a voicemail box nobody checks in the week after a mailing, the notice is technically complete and practically useless.
Delay, and the record that justifies it
Notice may be reasonably delayed to determine the scope of the breach and restore the reasonable integrity of the system. It may also be delayed when, after the entity notifies a law enforcement agency, that agency determines and advises that notice would impede a criminal or civil investigation or jeopardize homeland or national security. Notice follows without unreasonable delay once the agency says the investigation no longer needs the silence.
Every delay rests on a fact someone has to be able to produce later: the scoping conclusion, the law enforcement contact, the date the agency cleared the notification. Write them down as they happen.
Vendors and processors
An entity that maintains computerized data it does not own or license must notify the owner or licensee without unreasonable delay after discovering a breach where personal information was, or is reasonably believed to have been, accessed and acquired. The owner then handles the statutory notice to residents and the Attorney General.
That makes the vendor contract a notification control. Insist on a window measured in hours, a named contact, an obligation to preserve evidence, and an obligation to cooperate with the investigation.
Enforcement
The Attorney General may bring an action and impose a civil penalty of up to $150,000 per breach, or per series of similar breaches discovered in a single investigation. The section does not limit an individual from recovering direct economic damages.
Entities with their own notification procedures that meet the timing requirements, entities subject to the Gramm-Leach-Bliley Act, and entities following their primary state or federal regulator are treated as compliant under the section’s own terms.
Where this work happens
We handle breach response, evidence preservation, and notification support for organizations in Alexandria, Fairfax, Falls Church, McLean, Great Falls, and Vienna. The incident response page describes how an engagement runs, and the service-area hub lists every city we serve.
This summary is informational and not legal advice. Whether a specific incident triggers notice under Virginia law, and what the notice must say, is a decision for your counsel on the facts of that incident.