Virginia Enacts the Consumer Data Protection Act

On March 10, 2021, Cravath prepared for its clients a memo entitled “Virginia Enacts the Consumer Data Protection Act,” which discusses broad new obligations on businesses in their capacity as controllers and processors of personal data imposed by the recently enacted Virginia Consumer Data Protection Act (the “CDPA”). Virginia is now the second U.S. state, after California, to have enacted a comprehensive data privacy and protection regime. The CDPA goes into effect on January 1, 2023, and while it differs in a number of important respects from the California Consumer Privacy Act—including in that it does not create a private right of action—its enactment represents a significant development in the U.S. regulatory landscape.

Please click here to read the memo.