The Virginia Consumer Data Protection Act (CDPA) is part of a new wave of data privacy legislation spreading across the United States, leaving businesses scrambling to adapt. As with these other laws, the first question businesses need to ask is, “Does the CDPA apply to us?”

To help answer that question, we’ll go over the CDPA’s applicability and geographical scope.

Does the CDPA Apply to Businesses Outside of Virginia?

Being a state law, it may seem reasonable to assume that the CDPA only applies to businesses located within Virginia, but that is not the case. The CDPA can apply to any business, regardless of where it is located.

How is that possible? The law is written not to regulate Virginia businesses, but instead to protect Virginia residents. Because data privacy is so closely tied to the internet and online businesses from all over the world can affect Virginians’ privacy, the CDPA focuses on the extent to which a business is collecting and processing data about people within the state, as discussed below.

What Businesses Are Affected by the CDPA?

Since geography has nothing to do with whether the CDPA applies, each business must perform the following two-step analysis to determine whether it must be in compliance.

1. Do you conduct business in Virginia or produce products and services that are targeted to Virginia residents?
2. Does your business do at least one of the following:some text
   1. Control or process the personal data of at least 100,000 VA residents in a calendar year
   2. Control or process the personal data of at least 25,000 VA residents and derive over 50% of gross revenue from the sale of personal information.
 

Conducting Business in Virginia

While there is not yet any explicit guidance on what this means, it is generally considered a low bar to meet. If you have an online business and sell products to people in Virginia, you are likely to be considered as “conducting business” in Virginia.

Controlling or Processing Personal Data

In order to calculate the totals in the second step of the analysis, it’s important to understand what it means to control or process personal data.

“Controlling” means you are the one determining how the data is used. For example, if you send promotional emails out to potential customers, it’s possible you use outside vendors both to collect email addresses and send the promotions out to your mailing list, but you are the one calling the shots, so you control that data. “Processing” includes essentially any handling of data, from performing analytics to simply storing it on a cloud server.

Personal data is any information “linked or reasonably linked to an identified or identifiable natural person.” This encompasses a wide range of information from phone numbers to IP addresses and cookie identifiers. It is this online data that is likely to account for most of your total number of consumers, as every unique visitor to your website from Virginia should be counted.

‍