Lion Cipher Lab
Does Virginia's VCDPA apply to you? Run both applicability prongs, map the consumer rights, and flag what needs a Data Protection Assessment
- GRC / Compliance
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Virginia was the SECOND US state to switch on a comprehensive privacy law, and it is in force today - so the moment a company has customers beyond California, this is one of the first laws it hits. It is also the template roughly twenty other states copied, which makes learning it a shortcut to learning most of them. But the details that differ from California are exactly the ones that flip an answer: the VCDPA has no revenue-dollar trigger at all, so a business that would be squarely covered in California can be entirely out in Virginia; it carves out B2B and HR data permanently, so 'we are…
What you'll learn
- running the VCDPA applicability test as TWO prongs instead of one, and seeing that both are consumer counts
- explaining why a business can clear a huge revenue bar and still be entirely out of the VCDPA
- applying the permanent B2B and HR/employee carve-out that removes commercial and employment data from scope
- telling a controller apart from a processor, and knowing which duties land on which
- recognizing sensitive data and knowing it needs opt-IN consent before processing, not merely a right to limit
- mapping the Virginia consumer rights onto an intake-to-response workflow with the 45-day clock and the MANDATORY appeal step
- listing the five kinds of processing that force a Data Protection Assessment
- contrasting the VCDPA against the CCPA/CPRA so 'we did California' is a specific list of deltas, not a yes or no
- building a multi-state matrix to the strictest common denominator instead of one programme per state
Steps in this lab
- The vocabulary, the citation, and who is on the other side of the table
- Set up the worksheet - four tabs, named now, filled as you go
- The applicability test - run BOTH prongs, and notice they are both counts
- Scope and definitions - the permanent B2B/HR carve-out, sensitive data, and the entity exemptions
- The consumer rights and the workflow - the 45-day clock and the MANDATORY appeal
- The obligations - the privacy notice, the five DPA triggers, and the processor contract
- VCDPA vs CCPA - the differences that change your answer (aside)
- The pro move - build to the multi-state matrix, not one law at a time