DPO SchoolDPO School

Virginia Consumer Data Protection Act

Virginia privacy law (VCDPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

A processor must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must also require confidentiality, deletion or return at the end, information to show compliance, cooperation with assessments (or an independent assessment arranged by the processor), and flow-down contracts with subcontractors.

Key points

  1. Processor assists with consumer requests, security and breach notice, and data protection assessments.

    Section: § 59.1-579(A)

  2. Binding contract with instructions, nature and purpose, data types, duration, and rights and obligations.

    Section: § 59.1-579(B)

  3. Duty of confidentiality for each person processing the data.

    Section: § 59.1-579(B)(1)

  4. Delete or return data at the end of services unless the law requires retention.

    Section: § 59.1-579(B)(2)

  5. Allow reasonable assessments, or arrange a qualified independent assessor and share the report on request.

    Section: § 59.1-579(B)(4)

  6. Subcontractors only under a written contract imposing the processor's obligations.

    Section: § 59.1-579(B)(5)

  7. Controller or processor status is a fact-based question.

    Section: § 59.1-579(D)

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Virginia statute

Reference material, not legal advice.