Virginia
For Virginia, statute citation is Va. Code § 18.2-186.6; individual notice deadline is without unreasonable delay; ag / regulator notice deadline is without unreasonable delay; consumer reporting agency notice trigger (residents) is more than 1,000 persons at one time; encryption safe harbor is yes, recorded from its source on 2026-08-18.
- State
- Virginia
- Statute citation
- Va. Code § 18.2-186.6
- Individual notice deadline
- without unreasonable delay verified
- AG / regulator notice deadline
- without unreasonable delay verified
- Consumer reporting agency notice trigger (residents)
- more than 1,000 persons at one time verified
- Encryption safe harbor
- yes our reading
- Notes
- AG notice (Office of the Attorney General) is concurrent with individual notice — no separate threshold for AG notification; both are required 'without unreasonable delay'. CRA notice at 1,000+ also triggers concurrent AG notice. GLBA-regulated financial institutions are exempt under subsection G. Statute applies only where breach 'causes, or the individual or entity reasonably believes has caused or will cause, identity theft or another fraud'. our reading
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
B. If unencrypted or unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and causes, or the individual or entity reasonably believes has caused or will cause, identity theft or another fraud to any resident of the Commonwealth, an individual or entity that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay. Notice required by this section may be reasonably delayed to allow the individual or entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system. Notice required by this section may be delayed if, after the individual or entity notifies a law-enforcement agency, the law-enforcement agency determines and advises the individual or entity that the notice will impede a criminal or civil investigation, or homeland or national security. Notice shall be made without unreasonable delay after the law-enforcement agency determines that the notification will no longer impede the investigation or jeopardize national or homeland security. C. An individual or entity shall disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such a breach has caused or will cause identity theft or other fraud to any resident of the Commonwealth. D. An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system without unreasonable delay following discovery of the breach of the security of the system, if the personal information was accessed and acquired by an unauthorized person or the individual or entity reasonably believes the personal information was accessed and acquired by an unauthorized person. E. In the event an individual or entity provides notice to more than 1,000 persons at one time pursuant to this section, the individual or entity shall notify, without unreasonable delay, the Office of the Attorney General and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a (p), of the timing, distribution, and content of the notice.
— law.lis.virginia.gov, retrieved 2026-08-18
Source
- law.lis.virginia.govhttps://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/