Virginia residents, who use business services through websites or other means, are called “consumers” under the Virginia Consumer Data Protection Act (VCDPA). A business can be covered by the VCDPA either as a “controller” of personal data, to whom the consumers' personal data belongs; or a “processor” that manages the personal data like “collection, use, storage, disclosure, analysis, deletion, or modification” on behalf of a controller. Controllers and processors must sign a data processing agreement. Controllers are responsible for receiving, authenticating, and complying with the VCDPA and reasonable consumer personal data requests and setting up an appeals process for requests they deny if any. Processors comply mainly through their contracts with controllers, which must have a data processing agreement and include instructions and details on processing personal data. Find out more about the latest privacy laws at CookieScript.