The Letter About Your Information
Va. Code 18.2-186.6 — without unreasonable delay, and the Attorney General above 1,000
In Virginia, where unencrypted or unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person, and that causes or is reasonably believed to cause identity theft or another fraud to a resident, the individual or entity that owns or licenses the data discloses the breach to the affected residents without unreasonable delay.
| Who is told | When, as the section puts it |
|---|---|
| Who is toldEach affected resident | When, as the section puts itWithout unreasonable delay, or after law enforcement says notice will no longer impede its investigation |
| Who is toldThe Office of the Attorney General and the consumer reporting agencies, if more than 1,000 persons are notified at one time | When, as the section puts itWithout unreasonable delay |
| Who is toldAn entity that maintains data it does not own | When, as the section puts itTells the owner without unreasonable delay after discovering the breach |
- The Office of the Attorney General may impose a civil penalty of up to $150,000 per breach, or per series of similar breaches discovered in a single investigation.
What counts as personal information, the forms notice may take, and the exceptions for encrypted data are in the section and are not reproduced in full here. Whether a notice was required or on time is a question for the attorney general, a court, and a licensed Virginia attorney.
Sources for this section (1)
- Va. Code 18.2-186.6 — Breach of personal information notification
Legal information, not legal advice. Verified as of September 2026. Applying it to a particular situation is the work of a licensed Virginia attorney.