Get help →
Home›Obligations›United States›By state›Virginia

What a Virginia business has to have in writing

Virginia's headline written-policy duty is the Consumer Data Protection Act, the second comprehensive US privacy law to take effect, which forces a public privacy notice and documented data protection assessments.

Employment paperwork grew in 2026: every public and internal job posting must now carry a good-faith wage or salary range, employers of five or more must post and hand out a pregnancy accommodation notice and put it in the handbook, and any employer using a non-compete has to post the statute, though there is still no sexual harassment policy mandate.

VOSH runs the state OSHA plan with ten Virginia-only standards, insurers domiciled here certify a written information security program to the Bureau of Insurance every February with no small-company exemption, and any supplier selling cloud software to a state agency goes through VITA's COV Ramp security assessment.

Virginia has a rule of its own in 11 of the 14 areas, listed below. In 3 more we searched the state's own site and found nothing beyond the federal rule, but we have not finished writing up where we looked, so those are not shown yet.

Headcount

Industry  General is always on

Share
Ad from the publisher
Policy  Acknowledgment  Proof
VirginiaHandbook 2026acknowledged by name
Virginia on Recordwith AllyMatter
Cover Virginia the Modern WayEvery policy Virginia makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Virginia on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
See how it works →Pricing →

Virginia rules for a 15–19 person general business

We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether Virginia has a rule of its own on top. The federal rules every employer carries follow the Virginia rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by
Breach of personal information notificationVa. Code § 18.2-186.6; § 32.1-127.1:05 for medical information #Any individual or entity that owns or licenses computerized data containing unencrypted personal information about Virginia residentsDistribute
Notice
Write and send notice without unreasonable delay to every Virginia resident whose unencrypted personal information was accessed and acquired by an unauthorized person and is likely to cause identity theft or fraud, describing the incident, the data types involved, what the business has done and the contact details for the credit bureaus and regulators. Send the same notice to the Attorney General, and alert the consumer reporting agencies when more than 1,000 residents are notified at once.
From the first employee
Virginia Attorney General
AuthorityVirginia Law Portal - Va. Code § 18.2-186.6Virginia Law Portal - Va. Code § 32.1-127.1:05 (medical information breach)Report an error

Consumer Privacy Law 1Rights, notices and assessments for consumer data

LawProduceWhat it requiresTriggerEnforced by
Virginia Consumer Data Protection Act (VCDPA)Va. Code §§ 59.1-575 through 59.1-585 #Businesses that operate in Virginia or target Virginia residents and, in a calendar year, control or process personal data of 100,000+ consumers, or of 25,000+ consumers while earning more than half of gross revenue from selling personal dataWrite
Written policy
Publish a privacy notice listing the categories of personal data processed and shared, the purposes, the categories of third parties and how consumers exercise their rights and appeal a refusal. Record a data protection assessment for targeted advertising, data sales, certain profiling and any sensitive data processing. Get opt-in consent before processing sensitive data, put a written contract in place with every processor, and answer access, correction, deletion, portability and opt-out requests within 45 days.
From the first employee
Virginia Attorney General (exclusive enforcement; 30-day cure period)
AuthorityVirginia Law Portal - Va. Code § 59.1-575 (scope)Virginia Law Portal - Va. Code § 59.1-578 (controller duties and privacy notice)Virginia Law Portal - Chapter 53, Consumer Data Protection ActReport an error

Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data

LawProduceWhat it requiresTriggerEnforced by
Consent requirement for reproductive and sexual health information (Virginia Consumer Protection Act)Va. Code § 59.1-200 A 85 (SB 754 of 2025) #Any supplier in a consumer transaction that handles personally identifiable reproductive or sexual health information about a Virginia consumer; Gramm-Leach-Bliley data is carved out. There is no revenue or volume threshold, so it reaches businesses too small for the VCDPAWrite
Written policy
Build a written consent step and keep the record of it before obtaining, disclosing, selling or passing on any information that identifies a consumer's reproductive or sexual health, including diagnoses, treatment, medication, bodily functions and precise location near a health facility.
From the first employee
Virginia Attorney General; private right of action for actual damages or $500, whichever is greater
AuthorityVirginia Law Portal - Va. Code § 59.1-200 (prohibited practices)Virginia LIS - SB 754 (2025) bill statusReport an error

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by
Virginia Occupational Safety and Health program (VOSH State Plan)Va. Code Title 40.1 chapter 3; 16VAC25-60 (Administrative Regulation); 29 CFR 1952 #All private-sector employers in Virginia plus state and local governmentWrite
Written program
Follow federal OSHA standards as adopted by the Safety and Health Codes Board plus nine Virginia-only standards (administrative regulation, telecommunications confined space and approach distances, tree trimming, reverse signal operation, steel erection fall protection, construction sanitation and field sanitation). Post the VOSH job safety and health notice, keep the OSHA 300 injury and illness records, post the annual 300A summary, and report a workplace fatality within eight hours and an inpatient hospitalization, amputation or eye loss within 24 hours. Virginia does not require a general written safety and health program; a statutory heat illness prevention standard is due to be adopted by May 1, 2028.
From the first employee
Virginia Department of Labor and Industry (VOSH)
AuthorityVirginia DOLI - VOSH programVirginia DOLI - Virginia Unique StandardsOSHA - Virginia State PlanVirginia Law Portal - 16VAC25-60-40 (posting requirements)Report an error

State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state

LawProduceWhat it requiresTriggerEnforced by
COV Ramp (Commonwealth of Virginia cloud oversight and assessment, formerly ECOS)Va. Code § 2.2-2009; VITA Buy IT Manual Chapter 28; VITA Security Standard SEC530 and SEC525 #Suppliers of third-party hosted cloud services (SaaS and PaaS) to Virginia executive, legislative and judicial branch agencies and independent agenciesCertify
Certification
Complete VITA's pre-procurement cloud security assessment questionnaire and satisfy the Commonwealth's information security policies, standards and guidelines before an agency may award. VITA reviews the answers, records any approved security exceptions, and lists the approved product on the COV Ramp Approved Applications List; an approval lasts twelve months. Cloud contracts also carry mandatory VITA cloud terms and conditions, and approved suppliers submit monthly performance, service-level and security conformance artefacts for ongoing oversight, with an annual and end-of-contract review. Failure to answer, negotiate or comply can remove a supplier from consideration.
From the first employee
Virginia Information Technologies Agency, Commonwealth Security and Risk Management Division
AuthorityVirginia IT Agency - COV RampVirginia IT Agency - Buy IT Manual Chapter 28, Agency IT Procurement Security and Cloud RequirementsVirginia IT Agency - Cloud ServicesReport an error

Required Postings 1The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by
Required workplace postersVa. Code §§ 40.1-28.7:8, 40.1-51.2, 40.1-103, 65.2-405; 16VAC25-60-40 #Every Virginia employerPost
Posting
Display the Department of Labor and Industry poster set where employees can see it: job safety and health protection (VOSH), the whistleblower notice, earned income tax credit, child labor, workers' compensation notice of coverage, unemployment insurance, minimum wage and the pregnancy accommodation notice, plus the non-compete notice if the employer uses restrictive covenants.
From the first employee
Virginia Department of Labor and Industry
AuthorityVirginia DOLI - Required Workplace PostersVirginia Law Portal - 16VAC25-60-40Report an error

Pay Transparency 1Salary ranges in job posts and pay disclosure on request

LawProduceWhat it requiresTriggerEnforced by
Wage or salary range transparency; salary history banAccessed and verified  2026-10-07Va. Code § 40.1-28.7:12 (2026, cc. 996, 1063) #All employers hiring in VirginiaPost
Posting
Disclose the wage, salary, or wage or salary range in every public and internal posting for a job, promotion, transfer or other employment opportunity, and set that range in good faith by reference to a pay scale, a previously set range, what people in equivalent posts are actually paid, or the budget for the role. Do not ask for or rely on an applicant's pay history, and do not refuse to interview, hire, promote or otherwise retaliate against someone for withholding pay history or asking for the range. A non-compliant posting can be fixed within 15 business days of written notice.
From the first employee
Virginia Attorney General; private civil action within one year
AuthorityCode of Virginia - § 40.1-28.7:12Code of Virginia - Title 40.1, Chapter 3, Protection of EmployeesCode of Virginia - § 40.1-28.7:9, limiting employees' sharing wage information prohibitedReport an error

Licensing and Certifications 1Registrations, licenses and certifications a business or its staff must hold

LawProduceWhat it requiresTriggerEnforced by
Business entity registration (State Corporation Commission, Clerk's Office)Va. Code Title 13.1 (corporations and LLCs); Title 50 (partnerships); Va. Code § 59.1-69 (fictitious names) #Every corporation, LLC, limited partnership, business trust or nonprofit formed in or transacting business in Virginia, plus anyone trading under an assumed nameFile
Filing / record
File articles of formation or a foreign registration through the SCC Clerk's Information System, appoint and keep a registered agent and registered office in Virginia, file the annual report and pay the annual registration fee to stay in good standing, and record a fictitious name certificate with the Clerk if trading under a different name.
From the first employee
Virginia State Corporation Commission, Office of the Clerk
AuthorityVirginia SCC - Office of the Clerk (business entity filings)Virginia SCC - Clerk's Information System (CIS) online filing portalVirginia Law Portal - Title 13.1, CorporationsReport an error

Other Written Policies 5Any other document the state makes an employer write or hand out

LawProduceWhat it requiresTriggerEnforced by
Pregnancy, childbirth and lactation accommodation notice (Virginia Human Rights Act)Va. Code § 2.2-3909 D #Employers with five or more employees for each working day in 20 or more calendar weeks in the current or preceding yearWrite
Written policy
Write up employees' rights to reasonable accommodation for pregnancy, childbirth and related conditions including lactation, post it conspicuously, include it in any employee handbook, give it to every new hire on their first day, and hand it to an employee within 10 days of her telling the employer she is pregnant. Run a documented interactive process on each accommodation request.
5+ employees
Virginia Office of Civil Rights (Office of the Attorney General); local human rights commissions; private civil action
AuthorityVirginia Law Portal - Va. Code § 2.2-3909Virginia DOLI - Required Workplace PostersReport an error
Non-compete ban for low-wage employees and posting dutyVa. Code § 40.1-28.7:8 #Every employer that enters into or keeps covenants not to compete; the ban covers employees earning less than the state average weekly wage, and from July 1, 2025 anyone eligible for overtimePost
Posting
Stop using non-compete covenants with low-wage employees, and post a copy of the statute or the Department of Labor and Industry's approved summary alongside the other required workplace notices. Employers that fail to post get a warning first, then civil penalties for repeat failures.
From the first employee
Virginia Department of Labor and Industry; private civil action by the employee
AuthorityVirginia Law Portal - Va. Code § 40.1-28.7:8Virginia DOLI - Required Workplace PostersReport an error
Written wage statement on every paydayVa. Code § 40.1-29 C #Every Virginia employerDistribute + ack
Notice
Give each employee a written statement, on paper or through an accessible electronic system, on every regular pay date showing the employer's name and address, the number of hours worked, the rate of pay, the gross wages earned and the amount and purpose of every deduction.
From the first employee
Virginia Department of Labor and Industry; private civil action
AuthorityVirginia Law Portal - Va. Code § 40.1-29Virginia DOLI - Payment of Wage Law resourcesReport an error
Employee right to a copy of their employment recordVa. Code § 8.01-413.1 #Every Virginia employer holding employment recordsFile
Filing / record
Keep employment records in a form that can be produced, and within 30 days of a written request from a current or former employee (or their lawyer or personal representative) supply copies of records reflecting dates of employment, wages, job description and title, and any injury the employer sustained knowledge of. Notify the requester in writing if the deadline cannot be met.
From the first employee
Virginia circuit and general district courts (subpoena and civil penalty)
AuthorityVirginia Law Portal - Va. Code § 8.01-413.1Virginia DOLI - Labor and employment law resourcesReport an error
Workers' compensation coverage and noticeVa. Code §§ 65.2-800 through 65.2-813 #Employers that regularly employ three or more part-time or full-time employees; construction contractors count subcontractors' employeesFile
Filing / record
Buy a workers' compensation policy or qualify as a self-insurer, have the insurer file proof of coverage with the Workers' Compensation Commission, post the Commission's notice of coverage and panel of physicians where employees can see it, and report every work injury to the Commission on the required form.
3+ employees
Virginia Workers' Compensation Commission
AuthorityVirginia Workers' Compensation Commission - EmployersVirginia Law Portal - Va. Code § 65.2-800Report an error

Because You Are in Construction 1Industry layer

LawProduceWhat it requiresTriggerEnforced by
Contractor licensing (Board for Contractors)Va. Code Title 54.1 chapter 11; 18VAC50-22 #Anyone bidding on or performing construction, removal, repair or improvement work in Virginia worth $1,000 or more; the Class C, B and A tiers track project and annual dollar volumeCertify
Certification
Hold the right class of contractor license with the specialty designations for the work performed, name a qualified individual and designated employee who have passed the required exams and pre-license education, renew every two years, and use written contracts that carry the license number and the disclosures the Board's regulations require.
From the first employee
Virginia Department of Professional and Occupational Regulation, Board for Contractors
AuthorityVirginia DPOR - Board for ContractorsVirginia Law Portal - Title 54.1 chapter 11 (contractors)Virginia Law Portal - 18VAC50-22 (Board for Contractors Regulations)Report an error

Because You Are in Healthcare 1Industry layer

LawProduceWhat it requiresTriggerEnforced by
Paid sick leave for home health workersVa. Code §§ 40.1-33.3 through 40.1-33.6 #Employers of home health workers who provide personal care, respite or companion services under Virginia's Medicaid consumer-directed services program and average at least 20 hours a week or 90 hours a monthWrite
Written policy
Set up a written accrual and usage policy giving covered home health workers at least one hour of paid sick leave for every 30 hours worked, up to 40 hours a year, usable for the worker's own or a family member's illness, preventive care or treatment, and keep a record showing accrual and use without retaliating against workers who take it.
From the first employee
Virginia Department of Labor and Industry
AuthorityVirginia Law Portal - Va. Code § 40.1-33.4 (accrual)Virginia Law Portal - Va. Code § 40.1-33.3 (definitions)Virginia Law Portal - Va. Code § 40.1-33.5 (use of leave)Report an error

Because You Are in Food & Beverage 1Industry layer

LawProduceWhat it requiresTriggerEnforced by
Food establishment permit and Certified Food Protection ManagerVa. Code Title 35.1; 12VAC5-421 (Food Regulations) #Restaurants, caterers, mobile food units, temporary food establishments and other retail food businesses inspected by the Department of HealthCertify
Certification
Apply for and hold a Health Department food establishment permit before opening, and employ at least one supervisory person holding a Certified Food Protection Manager credential from a Conference for Food Protection accredited program, unless the establishment fits an exemption. Keep the certificate on file for inspectors along with employee health agreements and required procedures.
From the first employee
Virginia Department of Health, Office of Environmental Health Services
AuthorityVirginia Department of Health - Certified Food Protection ManagerVirginia Department of Health - Food Establishment Permit ApplicationVirginia Department of Health - Food Safety in VirginiaReport an error

Because You Are in Financial & Tax 1Industry layer

LawProduceWhat it requiresTriggerEnforced by
Insurance Data Security ActVa. Code §§ 38.2-621 through 38.2-629 #Every person licensed, authorized or registered under Virginia insurance law. Unlike most states that copied the NAIC model, Virginia sets no small-licensee headcount exemption; the only carve-outs are HIPAA-covered licensees, covered agents of another licensee, and affiliates of depository institutions following the federal Interagency GuidelinesCertify
Certification
Write and maintain an information security program sized to the business, based on a documented risk assessment, naming the person responsible, covering access controls, encryption, vendor oversight, staff cybersecurity awareness training and an incident response plan, and report its status in writing to the board each year. Insurers domiciled in Virginia file a written certification of compliance with the Commissioner of Insurance by February 15 every year, and any licensee must notify the Commissioner within three business days of a cybersecurity event.
From the first employee
Virginia State Corporation Commission, Bureau of Insurance
AuthorityVirginia Law Portal - Va. Code § 38.2-623 (information security program)Virginia Law Portal - Va. Code § 38.2-629 (exceptions)Virginia Law Portal - Va. Code § 38.2-626 (notification to the Commissioner)Report an error

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Your business type, with Virginia on top

Small businessFederal + industry, with Virginia on topConstruction contractorsFederal + industry, with Virginia on topHealthcare practicesFederal + industry, with Virginia on topFood and beverage businessesFederal + industry, with Virginia on topTax and accounting firmsFederal + industry, with Virginia on topRegistered investment advisersFederal + industry, with Virginia on topInsurance agenciesFederal + industry, with Virginia on topRetail and e-commerceFederal + industry, with Virginia on topTrucking and logistics carriersFederal + industry, with Virginia on topNonprofitsFederal + industry, with Virginia on topFederal contractorsFederal + industry, with Virginia on top

For another state

Alabama12Alaska12Arizona11Arkansas14California24Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine15Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Washington21West Virginia14Wisconsin15Wyoming13

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Advertise Here

Sources

Virginia Law Portal - Va. Code § 18.2-186.6Virginia Law Portal - Va. Code § 32.1-127.1:05 (medical information breach)Virginia Law Portal - Va. Code § 59.1-575 (scope)Virginia Law Portal - Va. Code § 59.1-578 (controller duties and privacy notice)Virginia Law Portal - Chapter 53, Consumer Data Protection ActVirginia Law Portal - Va. Code § 59.1-200 (prohibited practices)Virginia LIS - SB 754 (2025) bill statusVirginia Law Portal - Va. Code § 38.2-623 (information security program)Virginia Law Portal - Va. Code § 38.2-629 (exceptions)Virginia Law Portal - Va. Code § 38.2-626 (notification to the Commissioner)Virginia DOLI - VOSH programVirginia DOLI - Virginia Unique StandardsOSHA - Virginia State PlanVirginia Law Portal - 16VAC25-60-40 (posting requirements)Virginia DOLI - Required Workplace PostersVirginia Law Portal - Va. Code § 40.1-33.4 (accrual)Virginia Law Portal - Va. Code § 40.1-33.3 (definitions)Virginia Law Portal - Va. Code § 40.1-33.5 (use of leave)Virginia SCC - Office of the Clerk (business entity filings)Virginia SCC - Clerk's Information System (CIS) online filing portalVirginia Law Portal - Title 13.1, CorporationsVirginia DPOR - Board for ContractorsVirginia Law Portal - Title 54.1 chapter 11 (contractors)Virginia Law Portal - 18VAC50-22 (Board for Contractors Regulations)Virginia Department of Health - Certified Food Protection ManagerVirginia Department of Health - Food Establishment Permit ApplicationVirginia Department of Health - Food Safety in VirginiaVirginia Law Portal - Va. Code § 2.2-3909Virginia Law Portal - Va. Code § 40.1-28.7:8Virginia Law Portal - Va. Code § 40.1-29Virginia DOLI - Payment of Wage Law resourcesVirginia Law Portal - Va. Code § 8.01-413.1Virginia Workers' Compensation Commission - EmployersVirginia Law Portal - Va. Code § 65.2-800Code of Virginia - § 40.1-28.7:12Code of Virginia - Title 40.1, Chapter 3, Protection of EmployeesCode of Virginia - § 40.1-28.7:9, limiting employees' sharing wage information prohibitedVirginia IT Agency - COV RampVirginia IT Agency - Buy IT Manual Chapter 28, Agency IT Procurement Security and Cloud RequirementsVirginia IT Agency - Cloud Services

About this data

Pages on this site are compiled by AllyMatter and checked against one or more sources, two or more where available. Each record shows its stage and date. Nothing here is legal, audit or tax advice, and policyandcompliance.com and AllyMatter, Inc. accept no responsibility for errors or for decisions made on it. Read the source, then decide.
How we compile and verify →

Think something is wrong?

[email protected]
Tell us the page and what you found. We check it against the source and fix it.

Want to advertise here?

[email protected]
Consultant listings, tool listings, press releases and the primary spot, flat fee, paid in advance. Prices and rules · Design examples · Press releases.