Virginia Consumer Data Protection Act, processing de-identified data (Va. Code 59.1-581(A))
De-identified data is outside "personal data", but only if the holder takes reasonable de-identification measures, publicly commits not to re-identify, and binds every recipient (such as an AI buyer) by contract.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“A. The controller in possession of de-identified data shall: ... 1. Take reasonable measures to ensure that the data cannot be associated with a natural person; ... 2. Publicly commit to maintaining and using de-identified data without attempting to re-identify the data; and ... 3. Contractually obligate any recipients of the de-identified data to comply with all provisions of this chapter.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide