Virginia data breach notification law and cyber insurance

What the statute requires

Virginia requires businesses to notify affected residents and the Attorney General of breaches of unencrypted personal information without unreasonable delay. Cyber liability insurance typically covers the forensics, notification, and legal review this statute requires.

Consumer notification deadline

Without unreasonable delay

Regulator notice

Notify the Virginia Attorney General without unreasonable delay when residents are notified.

Credit bureau notice

Notify consumer reporting agencies when a breach requires notice to more than 1,000 residents.

Safe harbor

Notification is not required if the compromised data was encrypted or redacted, or where an investigation finds no reasonable likelihood of harm.

Enforcement

The Attorney General may impose civil penalties for violations, and affected residents may recover direct economic damages.

Statutes and sources

• Virginia Breach of Personal Information Notification Law

  Va. Code sect. 18.2-186.6

Regulator: Virginia Attorney General . Last verified 2026-07-29 from the official source .

Cyber Liability in other states

• Alabama
• Alaska
• Arizona
• Arkansas
• California
• Colorado
• Connecticut
• Delaware
• District of Columbia
• Florida
• Georgia
• Hawaii
• Idaho
• Illinois
• Indiana
• Iowa
• Kansas
• Kentucky
• Louisiana
• Maine
• Maryland
• Massachusetts
• Michigan
• Minnesota
• Mississippi
• Missouri
• Montana
• Nebraska
• Nevada
• New Hampshire
• New Jersey
• New Mexico
• New York
• North Carolina
• North Dakota
• Ohio
• Oklahoma
• Oregon
• Pennsylvania
• Rhode Island
• South Carolina
• South Dakota
• Tennessee
• Texas
• Utah
• Vermont
• Washington
• West Virginia
• Wisconsin
• Wyoming

Back to the cyber liability coverage guide