Obligations United States Virginia
What a Virginia business has to have in writing
Virginia's headline written-policy duty is the Consumer Data Protection Act, the second comprehensive US privacy law to take effect, which forces a public privacy notice and documented data protection assessments.
Employment paperwork grew in 2026: every public and internal job posting must now carry a good-faith wage or salary range, employers of five or more must post and hand out a pregnancy accommodation notice and put it in the handbook, and any employer using a non-compete has to post the statute, though there is still no sexual harassment policy mandate.
VOSH runs the state OSHA plan with ten Virginia-only standards, insurers domiciled here certify a written information security program to the Bureau of Insurance every February with no small-company exemption, and any supplier selling cloud software to a state agency goes through VITA's COV Ramp security assessment.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
VirginiaHandbook 2026acknowledged by name
Virginia on Recordwith AllyMatter
Cover Virginia the Modern WayEvery policy Virginia makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Virginia on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Virginia rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Breach of personal information notificationAI-compiledVa. Code § 18.2-186.6; § 32.1-127.1:05 for medical informationAny individual or entity that owns or licenses computerized data containing unencrypted personal information about Virginia residentsDistribute
Notice
Write and send notice without unreasonable delay to every Virginia resident whose unencrypted personal information was accessed and acquired by an unauthorized person and is likely to cause identity theft or fraud, describing the incident, the data types involved, what the business has done and the contact details for the credit bureaus and regulators. Send the same notice to the Attorney General, and alert the consumer reporting agencies when more than 1,000 residents are notified at once.
From the first employee
Virginia Attorney General
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Virginia Consumer Data Protection Act (VCDPA)AI-compiledVa. Code §§ 59.1-575 through 59.1-585Businesses that operate in Virginia or target Virginia residents and, in a calendar year, control or process personal data of 100,000+ consumers, or of 25,000+ consumers while earning more than half of gross revenue from selling personal dataWrite
Written policy
Publish a privacy notice listing the categories of personal data processed and shared, the purposes, the categories of third parties and how consumers exercise their rights and appeal a refusal. Record a data protection assessment for targeted advertising, data sales, certain profiling and any sensitive data processing. Get opt-in consent before processing sensitive data, put a written contract in place with every processor, and answer access, correction, deletion, portability and opt-out requests within 45 days.
From the first employee
Virginia Attorney General (exclusive enforcement; 30-day cure period)
Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data
LawProduceWhat it requiresTriggerEnforced by
Consent requirement for reproductive and sexual health information (Virginia Consumer Protection Act)AI-compiledVa. Code § 59.1-200 A 85 (SB 754 of 2025)Any supplier in a consumer transaction that handles personally identifiable reproductive or sexual health information about a Virginia consumer; Gramm-Leach-Bliley data is carved out. There is no revenue or volume threshold, so it reaches businesses too small for the VCDPAWrite
Written policy
Build a written consent step and keep the record of it before obtaining, disclosing, selling or passing on any information that identifies a consumer's reproductive or sexual health, including diagnoses, treatment, medication, bodily functions and precise location near a health facility.
From the first employee
Virginia Attorney General; private right of action for actual damages or $500, whichever is greater
Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
Virginia Occupational Safety and Health program (VOSH State Plan)AI-compiledVa. Code Title 40.1 chapter 3; 16VAC25-60 (Administrative Regulation); 29 CFR 1952All private-sector employers in Virginia plus state and local governmentWrite
Written program
Follow federal OSHA standards as adopted by the Safety and Health Codes Board plus nine Virginia-only standards (administrative regulation, telecommunications confined space and approach distances, tree trimming, reverse signal operation, steel erection fall protection, construction sanitation and field sanitation). Post the VOSH job safety and health notice, keep the OSHA 300 injury and illness records, post the annual 300A summary, and report a workplace fatality within eight hours and an inpatient hospitalization, amputation or eye loss within 24 hours. Virginia does not require a general written safety and health program; a statutory heat illness prevention standard is due to be adopted by May 1, 2028.
From the first employee
Virginia Department of Labor and Industry (VOSH)
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
Insurance Data Security ActAI-compiledVa. Code §§ 38.2-621 through 38.2-629Every person licensed, authorized or registered under Virginia insurance law. Unlike most states that copied the NAIC model, Virginia sets no small-licensee headcount exemption; the only carve-outs are HIPAA-covered licensees, covered agents of another licensee, and affiliates of depository institutions following the federal Interagency GuidelinesCertify
Certification
Write and maintain an information security program sized to the business, based on a documented risk assessment, naming the person responsible, covering access controls, encryption, vendor oversight, staff cybersecurity awareness training and an incident response plan, and report its status in writing to the board each year. Insurers domiciled in Virginia file a written certification of compliance with the Commissioner of Insurance by February 15 every year, and any licensee must notify the Commissioner within three business days of a cybersecurity event.
From the first employee
Virginia State Corporation Commission, Bureau of Insurance
State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state
LawProduceWhat it requiresTriggerEnforced by
COV Ramp (Commonwealth of Virginia cloud oversight and assessment, formerly ECOS)AI-compiledVa. Code § 2.2-2009; VITA Buy IT Manual Chapter 28; VITA Security Standard SEC530 and SEC525Suppliers of third-party hosted cloud services (SaaS and PaaS) to Virginia executive, legislative and judicial branch agencies and independent agenciesCertify
Certification
Complete VITA's pre-procurement cloud security assessment questionnaire and satisfy the Commonwealth's information security policies, standards and guidelines before an agency may award. VITA reviews the answers, records any approved security exceptions, and lists the approved product on the COV Ramp Approved Applications List; an approval lasts twelve months. Cloud contracts also carry mandatory VITA cloud terms and conditions, and approved suppliers submit monthly performance, service-level and security conformance artefacts for ongoing oversight, with an annual and end-of-contract review. Failure to answer, negotiate or comply can remove a supplier from consideration.
From the first employee
Virginia Information Technologies Agency, Commonwealth Security and Risk Management Division
Paid Leave Policies 1Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Paid sick leave for home health workersAI-compiledVa. Code §§ 40.1-33.3 through 40.1-33.6Employers of home health workers who provide personal care, respite or companion services under Virginia's Medicaid consumer-directed services programme and average at least 20 hours a week or 90 hours a monthWrite
Written policy
Set up a written accrual and usage policy giving covered home health workers at least one hour of paid sick leave for every 30 hours worked, up to 40 hours a year, usable for the worker's own or a family member's illness, preventive care or treatment, and keep a record showing accrual and use without retaliating against workers who take it.
From the first employee
Virginia Department of Labor and Industry
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required workplace postersAI-compiledVa. Code §§ 40.1-28.7:8, 40.1-51.2, 40.1-103, 65.2-405; 16VAC25-60-40Every Virginia employerPost
Posting
Display the Department of Labor and Industry poster set where employees can see it: job safety and health protection (VOSH), the whistleblower notice, earned income tax credit, child labor, workers' compensation notice of coverage, unemployment insurance, minimum wage and the pregnancy accommodation notice, plus the non-compete notice if the employer uses restrictive covenants.
From the first employee
Virginia Department of Labor and Industry
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Wage or salary range transparency; salary history banAI-compiledVa. Code § 40.1-28.7:12 (2026, cc. 996, 1063)All employers hiring in VirginiaPost
Posting
Disclose the wage, salary, or wage or salary range in every public and internal posting for a job, promotion, transfer or other employment opportunity, and set that range in good faith by reference to a pay scale, a previously set range, what people in equivalent posts are actually paid, or the budget for the role. Do not ask for or rely on an applicant's pay history, and do not refuse to interview, hire, promote or otherwise retaliate against someone for withholding pay history or asking for the range. A non-compliant posting can be fixed within 15 business days of written notice.
From the first employee
Virginia Attorney General; private civil action within one year
Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity registration (State Corporation Commission, Clerk's Office)AI-compiledVa. Code Title 13.1 (corporations and LLCs); Title 50 (partnerships); Va. Code § 59.1-69 (fictitious names)Every corporation, LLC, limited partnership, business trust or nonprofit formed in or transacting business in Virginia, plus anyone trading under an assumed nameFile
Filing / record
File articles of formation or a foreign registration through the SCC Clerk's Information System, appoint and keep a registered agent and registered office in Virginia, file the annual report and pay the annual registration fee to stay in good standing, and record a fictitious name certificate with the Clerk if trading under a different name.
From the first employee
Virginia State Corporation Commission, Office of the Clerk
Contractor licensing (Board for Contractors)AI-compiledVa. Code Title 54.1 chapter 11; 18VAC50-22Anyone bidding on or performing construction, removal, repair or improvement work in Virginia worth $1,000 or more; the Class C, B and A tiers track project and annual dollar volumeCertify
Certification
Hold the right class of contractor licence with the specialty designations for the work performed, name a qualified individual and designated employee who have passed the required exams and pre-licence education, renew every two years, and use written contracts that carry the licence number and the disclosures the Board's regulations require.
From the first employee
Virginia Department of Professional and Occupational Regulation, Board for Contractors
Food establishment permit and Certified Food Protection ManagerAI-compiledVa. Code Title 35.1; 12VAC5-421 (Food Regulations)Restaurants, caterers, mobile food units, temporary food establishments and other retail food businesses inspected by the Department of HealthCertify
Certification
Apply for and hold a Health Department food establishment permit before opening, and employ at least one supervisory person holding a Certified Food Protection Manager credential from a Conference for Food Protection accredited programme, unless the establishment fits an exemption. Keep the certificate on file for inspectors along with employee health agreements and required procedures.
From the first employee
Virginia Department of Health, Office of Environmental Health Services
Other Written Policies 5Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Pregnancy, childbirth and lactation accommodation notice (Virginia Human Rights Act)AI-compiledVa. Code § 2.2-3909 DEmployers with five or more employees for each working day in 20 or more calendar weeks in the current or preceding yearWrite
Written policy
Write up employees' rights to reasonable accommodation for pregnancy, childbirth and related conditions including lactation, post it conspicuously, include it in any employee handbook, give it to every new hire on their first day, and hand it to an employee within 10 days of her telling the employer she is pregnant. Run a documented interactive process on each accommodation request.
5+ employees
Virginia Office of Civil Rights (Office of the Attorney General); local human rights commissions; private civil action
Non-compete ban for low-wage employees and posting dutyAI-compiledVa. Code § 40.1-28.7:8Every employer that enters into or keeps covenants not to compete; the ban covers employees earning less than the state average weekly wage, and from July 1, 2025 anyone eligible for overtimePost
Posting
Stop using non-compete covenants with low-wage employees, and post a copy of the statute or the Department of Labor and Industry's approved summary alongside the other required workplace notices. Employers that fail to post get a warning first, then civil penalties for repeat failures.
From the first employee
Virginia Department of Labor and Industry; private civil action by the employee
Written wage statement on every paydayAI-compiledVa. Code § 40.1-29 CEvery Virginia employerDistribute + ack
Notice
Give each employee a written statement, on paper or through an accessible electronic system, on every regular pay date showing the employer's name and address, the number of hours worked, the rate of pay, the gross wages earned and the amount and purpose of every deduction.
From the first employee
Virginia Department of Labor and Industry; private civil action
Employee right to a copy of their employment recordAI-compiledVa. Code § 8.01-413.1Every Virginia employer holding employment recordsFile
Filing / record
Keep employment records in a form that can be produced, and within 30 days of a written request from a current or former employee (or their lawyer or personal representative) supply copies of records reflecting dates of employment, wages, job description and title, and any injury the employer sustained knowledge of. Notify the requester in writing if the deadline cannot be met.
From the first employee
Virginia circuit and general district courts (subpoena and civil penalty)
Workers' compensation coverage and noticeAI-compiledVa. Code §§ 65.2-800 through 65.2-813Employers that regularly employ three or more part-time or full-time employees; construction contractors count subcontractors' employeesFile
Filing / record
Buy a workers' compensation policy or qualify as a self-insurer, have the insurer file proof of coverage with the Workers' Compensation Commission, post the Commission's notice of coverage and panel of physicians where employees can see it, and report every work injury to the Commission on the required form.
3+ employees
Virginia Workers' Compensation Commission
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Virginia on top
Small businessFederal + industry, with Virginia on topConstruction contractorsFederal + industry, with Virginia on topHealthcare practicesFederal + industry, with Virginia on topFood and beverage businessesFederal + industry, with Virginia on topTax and accounting firmsFederal + industry, with Virginia on topRegistered investment advisersFederal + industry, with Virginia on topInsurance agenciesFederal + industry, with Virginia on topRetail and e-commerceFederal + industry, with Virginia on topTrucking and logistics carriersFederal + industry, with Virginia on topNonprofitsFederal + industry, with Virginia on topFederal contractorsFederal + industry, with Virginia on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Virginia Law Portal - Va. Code § 18.2-186.6Virginia Law Portal - Va. Code § 32.1-127.1:05 (medical information breach)Virginia Law Portal - Va. Code § 59.1-575 (scope)Virginia Law Portal - Va. Code § 59.1-578 (controller duties and privacy notice)Virginia Law Portal - Chapter 53, Consumer Data Protection ActVirginia Law Portal - Va. Code § 59.1-200 (prohibited practices)Virginia LIS - SB 754 (2025) bill statusVirginia Law Portal - Va. Code § 38.2-623 (information security program)Virginia Law Portal - Va. Code § 38.2-629 (exceptions)Virginia Law Portal - Va. Code § 38.2-626 (notification to the Commissioner)Virginia DOLI - VOSH programVirginia DOLI - Virginia Unique StandardsOSHA - Virginia State PlanVirginia Law Portal - 16VAC25-60-40 (posting requirements)Virginia DOLI - Required Workplace PostersVirginia Law Portal - Va. Code § 40.1-33.4 (accrual)Virginia Law Portal - Va. Code § 40.1-33.3 (definitions)Virginia Law Portal - Va. Code § 40.1-33.5 (use of leave)Virginia SCC - Office of the Clerk (business entity filings)Virginia SCC - Clerk's Information System (CIS) online filing portalVirginia Law Portal - Title 13.1, CorporationsVirginia DPOR - Board for ContractorsVirginia Law Portal - Title 54.1 chapter 11 (contractors)Virginia Law Portal - 18VAC50-22 (Board for Contractors Regulations)Virginia Department of Health - Certified Food Protection ManagerVirginia Department of Health - Food Establishment Permit ApplicationVirginia Department of Health - Food Safety in VirginiaVirginia Law Portal - Va. Code § 2.2-3909Virginia Law Portal - Va. Code § 40.1-28.7:8Virginia Law Portal - Va. Code § 40.1-29Virginia DOLI - Payment of Wage Law resourcesVirginia Law Portal - Va. Code § 8.01-413.1Virginia Workers' Compensation Commission - EmployersVirginia Law Portal - Va. Code § 65.2-800Code of Virginia - § 40.1-28.7:12Code of Virginia - Title 40.1, Chapter 3, Protection of EmployeesCode of Virginia - § 40.1-28.7:9, limiting employees' sharing wage information prohibitedVirginia IT Agency - COV RampVirginia IT Agency - Buy IT Manual Chapter 28, Agency IT Procurement Security and Cloud RequirementsVirginia IT Agency - Cloud Services