AI Governance Engineer
GitHub

Virginia CDPA: data protection assessments, incl. risky profiling

Controllers document data protection assessments for targeted advertising, sale, profiling that presents a reasonably foreseeable risk, and sensitive data, for processing created after 2023-01-01, and give them to the Attorney General on request

By Reviewed

From clause to evidenceThe chain from Virginia CDPA § 59.1-580 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.ClauseVirginia CDPA§ 59.1-580Duty holderControllersApplies from2023-01-01In forceArtefactAssessmenttemplate per…LayersLayer 01Layer 05Evidence recordEvidence recordv1Same topic elsewhere: no crosswalk topic files this clause yetAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from Virginia CDPA § 59.1-580 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.ClauseVirginia CDPA · § 59.1-580Duty holderControllersApplies from2023-01-01 · In forceArtefactAssessment template per processing…LayersLayer 01Layer 05Evidence recordEvidence record v1Same topic elsewhere: no crosswalk topicfiles this clause yetAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-USVA-CDPA. Drawn from chapter 08.
Text alternative
  • Clause: Virginia CDPA, § 59.1-580.
  • Duty holder: Controllers.
  • Applies from: 2023-01-01, In force.
  • Artefact: Assessment template per processing….
  • Layers: Layer 01, Layer 05.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • No crosswalk topic files this clause yet.
Id
AIGE-OBL-USVA-CDPA
Instrument
Virginia Consumer Data Protection Act law
Clause
§ 59.1-580
In scope
Controllers
Authority
Attorney General
Applies from
In force · Processing created after 2023-01-01

The artefact that evidences it

Assessment template per processing activity; profiling register.

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

Source

Chapter 08, section State privacy and sector laws, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). Virginia CDPA: data protection assessments, incl. risky profiling (AIGE-OBL-USVA-CDPA). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-usva-cdpa. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{Virginia CDPA: data protection assessments, incl. risky profiling (AIGE-OBL-USVA-CDPA)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-usva-cdpa},
  note         = {Version 0.5.0}
}