1. Home
  2. State breach laws
  3. Virginia

Virginia data breach notification law

What Virginia requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Va. Code § 18.2-186.6.

No fixed deadline
Notification deadline
Required
AG notification
Limited
Private right of action
None
Liability protection

What this means if you sell security services

Virginia sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. Private-action exposure is limited, so the pressure is mostly regulatory and the pitch is about penalties, remediation, and not being on the list twice.

See recent Virginia breach filings →

Requirements in detail

Statute
Va. Code § 18.2-186.6
Deadline to notify residents
Without unreasonable delay after discovering or being notified of the breach. No fixed number of days applies. Notice may be reasonably delayed to determine the scope of the breach and restore the system, or delayed at law enforcement's request.
Attorney General notification
Yes, for every reportable breach, with no minimum number of residents, without unreasonable delay. When more than 1,000 people are notified at one time, the business must also tell the Attorney General and the nationwide consumer reporting agencies the timing, distribution, and content of the notice. Employers and payroll service providers must separately notify the Attorney General of breaches of employee taxpayer identification numbers combined with income tax withholding information.
Penalties
The Attorney General may bring an action and impose a civil penalty of up to $150,000 per breach, or per series of similar breaches discovered in a single investigation. State-chartered or licensed financial institutions are enforced exclusively by their primary state regulator, and entities regulated by the Bureau of Insurance are excluded.
Private right of action
Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.
Encryption exemption
Virginia's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Virginia has no law limiting breach lawsuits for organizations that maintain a security program.

Virginia breach notification FAQ

What is the data breach notification deadline in Virginia?

Without unreasonable delay after discovering or being notified of the breach. No fixed number of days applies. Notice may be reasonably delayed to determine the scope of the breach and restore the system, or delayed at law enforcement's request. The governing law is Va. Code § 18.2-186.6.

Does Virginia require notifying the Attorney General of a data breach?

Yes, for every reportable breach, with no minimum number of residents, without unreasonable delay. When more than 1,000 people are notified at one time, the business must also tell the Attorney General and the nationwide consumer reporting agencies the timing, distribution, and content of the notice. Employers and payroll service providers must separately notify the Attorney General of breaches of employee taxpayer identification numbers combined with income tax withholding information.

What are the penalties for failing to report a data breach in Virginia?

The Attorney General may bring an action and impose a civil penalty of up to $150,000 per breach, or per series of similar breaches discovered in a single investigation. State-chartered or licensed financial institutions are enforced exclusively by their primary state regulator, and entities regulated by the Bureau of Insurance are excluded.

Can individuals sue over a data breach in Virginia?

Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.

Does encrypted data need to be reported in Virginia?

Virginia's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Virginia limit breach lawsuits for companies with a cybersecurity program?

No. Virginia has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Virginia Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →