The Virginia Consumer Data Protection Act (CDPA) passed on March 2, 2021, making it the next major state since California to shape the US Privacy landscape. The CDPA increases the protection of consumers’ data and will further expand consumer privacy rights for Virginia residents.
Though it shares similarities with the GDPR and CCPA, the CDPA establishes new definitions for geolocation data, profiling, targeted advertising, and the sale of personal data.
OneTrust helps organizations accelerate time to CDPA compliance. With a complete suite of technology solutions, OneTrust enables organizations to operationalize and automate CDPA requirements across consumer rights and privacy governance operations.
Get regulatory updates and report to your board
Automate the fulfillment of data subject rights requests
Manage internal workflows, tasks, and reporting
Access a centralized repository of CDPA resources that includes the full CDPA text, summaries, comprehensive guides, and regulatory guidance. Stay up-to-date with the latest amendments, news, and guidance.
Leverage a CDPA readiness and planning report to assess your organization’s gaps and remediation recommendations to minimize risks. Opt-in to share your readiness and benchmark your program against 300+ other organizations.
Simplify request intake with pre-built web form templates and the drag-and-drop web form builder. Leverage CDPA-specific response workflows to help your organization respond to requests appropriately and adhere to the 45-day response timeline.
Comply with CDPA’s opt-out requirement and leverage website geo-targeting to ensure Virginia residents are seeing the appropriate opt-out controls, such as do not sell, do not profile, and do not use for targeted advertising requests. Track verifiable consumer consent and sync across systems to avoid the unauthorized sale of data.
Easily update, centralize, and distribute policies, notices, and disclosures across all web and mobile properties from a single platform. Update privacy notices to include consumers rights under the CDPA and direct consumers to a Consumer Rights intake form.
Track key attributes when mapping data for CDPA compliance. Additionally, leverage bulk importing capabilities to attach CDPA-specific data elements to existing data.
Leverage CDPA-specific PIAs when doing certain types of data processing. Ensure adherence to the data minimization and purpose limitation consideration as outlined under the CDPA.
Take a proactive approach to incident management and decrease risks and other potential negative impacts should a breach occur. Analyze incidents with a built-in, Virginia Data Breach Notification assessment template.
Operationalize CDPA requirements across opt-out of sale, consumer rights, and privacy governance operations.
