The VCDPA also provides protections against discrimination if/when consumers elect to exercise their rights and gives consumers the ability to opt-out of the sale of their personal data, targeted advertising, and certain profiling. To learn more about how to utilize Microsoft products, services, and administrative tools to help find and 'act' on personal data, see Data Subject Requests and the GDPR and CCPA.
The VCDPA requires regulated business to respond to requests to exercise consumer rights within 45 days, and this period can be extended for an additional 45 days if notice is provided to the requesting consumer explaining the reason for such delay. The VCDPA also provides consumers with the right to appeal a business's refusal of such a request through an appeal process provided by the business that must be 'conspicuously available.' A business must respond to an appeal in writing within 60 days; if the appeal is denied, the business must provide the consumer with an 'online mechanism (if available) or other method' through which a consumer can submit a complaint to the AG.