Virginia CDPA

Consumer Data Protection Act - controller and processor obligations, consumer rights, DPIA.


Short name	VA CDPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers VA CDPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for VA CDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for VA CDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`VA-CDPA-578-SEC` Reasonable Data Security Practices	Controllers must establish and maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the personal data processed; verifiable integrity of the software processing that data is a core technical safeguard (Va. Code § 59.1-578(A)(3))	Scan
`VA-CDPA-578-MIN` Data Minimisation Accountability	Collection must be limited to what is adequate, relevant and reasonably necessary for disclosed purposes; honoring this duty presumes the controller can name the processing system and enumerate the software components that touch personal data (Va. Code § 59.1-578(A)(1))	Scan
`VA-CDPA-579` Processor and Vendor Oversight	Processing by third parties must be governed by binding contracts and processors must assist controllers with their obligations; oversight requires knowing who supplies each component in the processing stack (Va. Code § 59.1-579)	Scan
`VA-CDPA-580` Data Protection Assessment Readiness	Controllers must conduct data protection assessments for targeted advertising, sale, profiling and other heightened-risk processing; assessing risk credibly requires versioned identification of the software involved (Va. Code § 59.1-580)	Scan
`VA-CDPA-577` Consumer Rights Response Readiness	Controllers must respond to consumer access, correction, deletion and portability requests within 45 days; locating a consumer's data across systems depends on those systems' components being unambiguously identifiable (Va. Code § 59.1-577)	Scan
`VA-CDPA-578-NOTICE` Transparent Processing Documentation	Controllers must provide consumers a reasonably accessible, clear privacy notice describing their processing; the underlying system documentation should itself be identified and timestamped to support the notice's accuracy (Va. Code § 59.1-578, privacy-notice provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`59.1-577`	Consumer Rights: Access, Portability & Correction
`59.1-578`	Consumer Right to Delete
`59.1-580`	Opt-Out of Sale, Targeted Advertising & Profiling
`59.1-579`	Sensitive Data: Consent Requirement
`59.1-581`	Data Protection Assessment (DPA) Requirement
`59.1-583`	Processor Agreements
`59.1-576`	Privacy Notice Transparency
`59.1-582`	Appeal Process for Consumer Requests
`59.1-584`	Data Minimization & Purpose Limitation
`59.1-585`	Security Safeguards

Policy templates

Written for VA CDPA:

Virginia CDPA State Privacy Notice
Virginia CDPA Consumer Rights Request Handling Procedure
Virginia CDPA Data Protection Assessment Procedure

And 22 from the standard set, adapted to VA CDPA.