1. Home
  2. State breach laws
  3. West Virginia

West Virginia data breach notification law

What West Virginia requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by W. Va. Code §§ 46A-2A-101 to 46A-2A-105 (notice requirement at § 46A-2A-102).

No fixed deadline
Notification deadline
Not required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

West Virginia sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. There is no Attorney General notice requirement, so West Virginia incidents surface mainly through SEC and HHS filings and through other states' records, channels fewer competitors watch. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent West Virginia breach filings →

Requirements in detail

Statute
W. Va. Code §§ 46A-2A-101 to 46A-2A-105 (notice requirement at § 46A-2A-102)
Deadline to notify residents
Without unreasonable delay after discovering or being notified of the breach. No fixed number of days applies. Delay is allowed to determine the scope of the breach and restore the system, or if law enforcement advises that notice would impede an investigation or national security.
Attorney General notification
No. The statute does not require notice to the Attorney General. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 people must be notified, unless the entity is subject to the Gramm-Leach-Bliley Act.
Penalties
Failing to give the required notice is an unfair or deceptive act under the state Consumer Credit and Protection Act, and the Attorney General has exclusive authority to sue. A court may impose a civil penalty only if it finds a course of repeated and willful violations, and the penalty may not exceed $150,000 per breach or series of similar breaches discovered in a single investigation. Licensed financial institutions are enforced exclusively by their primary functional regulator.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
West Virginia's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. West Virginia has no law limiting breach lawsuits for organizations that maintain a security program.

West Virginia breach notification FAQ

What is the data breach notification deadline in West Virginia?

Without unreasonable delay after discovering or being notified of the breach. No fixed number of days applies. Delay is allowed to determine the scope of the breach and restore the system, or if law enforcement advises that notice would impede an investigation or national security. The governing law is W. Va. Code §§ 46A-2A-101 to 46A-2A-105 (notice requirement at § 46A-2A-102).

Does West Virginia require notifying the Attorney General of a data breach?

No. The statute does not require notice to the Attorney General. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 people must be notified, unless the entity is subject to the Gramm-Leach-Bliley Act.

What are the penalties for failing to report a data breach in West Virginia?

Failing to give the required notice is an unfair or deceptive act under the state Consumer Credit and Protection Act, and the Attorney General has exclusive authority to sue. A court may impose a civil penalty only if it finds a course of repeated and willful violations, and the penalty may not exceed $150,000 per breach or series of similar breaches discovered in a single investigation. Licensed financial institutions are enforced exclusively by their primary functional regulator.

Can individuals sue over a data breach in West Virginia?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in West Virginia?

West Virginia's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does West Virginia limit breach lawsuits for companies with a cybersecurity program?

No. West Virginia has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the West Virginia Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →