ShareAndGoShareAndGo

Data breach notification

Virginia data breach notification law

Virginia's breach rule is Va. Code Ann. § 18.2-186.6.

It sends the Office of the Attorney General and affected residents notice together, "without unreasonable delay."

Attorney General and residents at the same time

The core sentence reads that the business "shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay."

Virginia sets no headcount for this. It names the Office of the Attorney General for any breach that requires notice to residents.

Above 1,000 residents, the consumer reporting agencies are told too.

There is no number of days. The measure is without unreasonable delay.

The fraud trigger

Notice is owed where the breach "causes, or the individual or entity reasonably believes has caused or will cause, identity theft or another fraud to any resident of the Commonwealth".

A breach that does none of those things, and is not reasonably believed to, falls outside the duty.

Covered information

Personal information is a first name or first initial and last name "in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted nor redacted".

  • Social Security number
  • driver's license or state identification card number
  • account or card number with any required code or password
  • passport number
  • military identification number

Encrypted data still counts if it was acquired in unencrypted form or together with the key.

Where ShareAndGo fits

Richmond and Northern Virginia firms trade passport scans and military ID copies with contractors and agencies.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

The watermark is a per-room setting, on by default, so each viewed page names its reader. Each group sees only its own folders, recipients enter with a six-digit code and no account, and the chained log exports as CSV.

Virginia FAQ

Is the Attorney General told only for large breaches?
No. The Office of the Attorney General is told for any breach that requires notice to residents.
Are passport and military ID numbers covered?
Yes, both are listed data elements.
What if the data was encrypted?
It is outside the definition unless acquired in unencrypted form or with the key.
Does redaction take data outside the definition?
Yes. The definition covers data elements that are neither encrypted nor redacted.
Is there a fixed number of days?
No. Residents and the Office of the Attorney General are told without unreasonable delay following discovery or notification of the breach.
Who else is told in a large breach?
The consumer reporting agencies, once more than 1,000 residents are involved.

Source checked

Read from the Code of Virginia on the Virginia Legislative Information System site.

Checked against Virginia's published law on November 2, 2026. This is general information, not legal advice.

More pages

Breach notification laws by state

Every jurisdiction's breach law.

ShareAndGo vs DataRooms.com

Data room comparison.

ShareAndGo home

ShareAndGo home.