---
title: "Virginia privacy law (VCDPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/virginia/processors"
source: "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Virginia Consumer Data Protection Act

# Virginia privacy law (VCDPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

A processor must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must also require confidentiality, deletion or return at the end, information to show compliance, cooperation with assessments (or an independent assessment arranged by the processor), and flow-down contracts with subcontractors.

## Key points

1. Processor assists with consumer requests, security and breach notice, and data protection assessments.

   Section: [§ 59.1-579(A)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

2. Binding contract with instructions, nature and purpose, data types, duration, and rights and obligations.

   Section: [§ 59.1-579(B)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

3. Duty of confidentiality for each person processing the data.

   Section: [§ 59.1-579(B)(1)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

4. Delete or return data at the end of services unless the law requires retention.

   Section: [§ 59.1-579(B)(2)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

5. Allow reasonable assessments, or arrange a qualified independent assessor and share the report on request.

   Section: [§ 59.1-579(B)(4)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

6. Subcontractors only under a written contract imposing the processor's obligations.

   Section: [§ 59.1-579(B)(5)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

7. Controller or processor status is a fact-based question.

   Section: [§ 59.1-579(D)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

## Sources

- [https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-579/](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-579/)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Virginia statute](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

Reference material, not legal advice.

## Other topics for Virginia

- [Applicability](https://dposchool.com/state-privacy-laws/state/virginia/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/virginia/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/virginia/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/virginia/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/virginia/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Virginia](https://dposchool.com/state-privacy-laws/state/virginia) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/virginia/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/virginia/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents