Skip to content
Network USA

VA · Breach notification statute

Virginia data breach notification law

A summary of the Virginia breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Va. Code Ann. § 18.2-186.6 (Crimes Involving Fraud - Breach of Personal Information Notification) (amended 2020)

Last amended
2020 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Without unreasonable delay Virginia requires businesses and individuals to notify affected residents and

Attorney general notice

Yes Virginia requires notification to the Office of the Attorney General for all breaches (under subsection

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

In Virginia 'personal information' means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted nor redacted: (1) Social security number; (2) Driver's license number or state identification card number issued in lieu of a driver's license number; (3) Financial account number, or credit card or debit card number, in combination with an

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Virginia

158 reports to HHS OCR affecting 25,324,969 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Virginia.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Maximus, Inc.Business Associate9,179,390Aug 4, 2023Hacking/IT IncidentArchive (closed)
Science Applications International Corporation (SABusiness Associate4,900,000Nov 4, 2011LossArchive (closed)
Dominion Dental Services, Inc., Dominion National Insurance Company, and Dominion Dental Services USA, Inc.Health Plan2,964,778Jun 21, 2019Hacking/IT IncidentArchive (closed)
Radiology Associates of Richmond, Inc.Healthcare Provider1,419,091Jul 1, 2025Hacking/IT IncidentUnder investigation
Virginia Department of Medical Assistance ServicesHealth Plan1,229,333Sep 18, 2023Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Virginia businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Virginia timing rule as: "Without unreasonable delay Virginia requires businesses and individuals to notify affected residents and". (Source: PRC 2026 survey extract.)

Does Virginia require notice to the attorney general?

The PRC 2026 extract notes: "Yes Virginia requires notification to the Office of the Attorney General for all breaches (under subsection". (Source: PRC 2026 survey extract.)

Does the Virginia law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Virginia breach law.

Does the Virginia law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Virginia breach law.

Does the Virginia law cover paper records?

No. The PRC 2026 survey records the Virginia law as covering computerised data only, not paper records.

Is there a private right of action in Virginia?

Yes. The PRC 2026 survey records a private right of action under the Virginia breach law.

Is credit monitoring required in Virginia?

No. The PRC 2026 survey does not record a credit monitoring requirement in Virginia.

How does the Virginia law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Virginia statute, and see our HIPAA vs state breach notification laws guide.

Sources