The Virginia Consumer Data Protection Act (CDPA) applies to any entity that conducts business in Virginia or produces services or products targeting Virginia residents and either controls or processes the personal data of at least 100,000 consumers during a calendar year or controls or processes the personal data of at least 25,000 consumers and derives at least 50% of its gross revenue from the sale of personal data.
There are five categories of organizations that are exempt from the CDPA: higher education institutions, nonprofit organizations, any financial institution subject to the Gramm-Leach-Bliley Act (GLBA), any business subject to the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) and anybody, authority, board, bureau, commission, district, or Virginian agency or any Virginian political subdivision.