Know what your organization owes, show that you met it, and keep the record.

California state technology statutes — the California Consumer Privacy Act, the first and most prescriptive of the US state consumer-privacy laws, plus real enacted coverage in breach notification (the nation's first, and the template nearly every other state statute was modeled on), the original SOPIPA (Student Online Personal Information Protection Act) student-data statute, the Genetic Information Privacy Act (GIPA), the all-party-consent California Invasion of Privacy Act (CIPA) with an active website-tracking-litigation profile, the original state IoT-security law (SB-327), the Delete Act's centralized data-broker deletion platform, DROP (the Delete Request and Opt-out Platform), three enacted AI statutes spanning frontier-model safety disclosure through bot disclosure, a right-to-repair statute, and one of the oldest state medical-records confidentiality statutes in the country, the Confidentiality of Medical Information Act (CMIA), predating HIPAA (the Health Insurance Portability and Accountability Act) by over a decade.

The European Union as a supranational jurisdiction — home to the General Data Protection Regulation, the most influential and most-copied data protection statute in the world, binding across all EU (European Union)/EEA (European Economic Area) member states and extending extraterritorially to any organization that offers goods or services to, or monitors the behavior of, individuals in the Union. It also carries the Union's cybersecurity, digital-resilience, data-sharing, and AI rules: the NIS2 Directive, the Digital Operational Resilience Act, the Cyber Resilience Act, the Data Act, and the AI Act.

Virginia state technology statutes. Virginia's flagship statute is the Virginia Consumer Data Protection Act (VCDPA), the original "Virginia model" comprehensive privacy law that Colorado, Connecticut, Texas, and most subsequent state statutes were patterned after. Virginia also has real, enacted coverage in breach notification (a harm-triggered statute unusually paired with a narrow direct-economic-damages private remedy), a layered pair of SOPIPA (Student Online Personal Information Protection Act)-style/data-security student-data statutes, a direct-to-consumer genetic-privacy statute requiring itemized per-use consent, a one-party-consent wiretapping statute distinctively paired with a civil cause of action and liquidated damages, a 2020 adoption of the NAIC (National Association of Insurance Commissioners) Insurance Data Security Model Law with an annual compliance-certification duty, a HIPAA (Health Insurance Portability and Accountability Act)-adjacent health-records-privacy and medical-breach-notification pairing, and two narrow but real AI-generated-content criminal statutes (deepfake nonconsensual imagery, computer-generated CSAM) — notwithstanding the Governor's March 2025 veto of Virginia's would-be comprehensive AI statute.

California privacy statute establishing consumer rights to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and receive notice at collection, together with CPPA (California Privacy Protection Agency) governance, rulemaking, and enforcement provisions.

The European Union's comprehensive data protection regulation, directly applicable across all EU (European Union)/EEA (European Economic Area) member states since May 25, 2018. It establishes the core principles governing any processing of personal data, enumerates the data subject rights (access, rectification, erasure, portability, and more) that give individuals control over their own information, sets out the distinct obligations of controllers and processors, and backs all of it with breach-notification duties and administrative fines that can reach 4% of global annual turnover. Its extraterritorial reach — Article 3 — means it applies to any organization, anywhere, that offers goods or services to individuals in the EU or monitors their behavior, which is why it is treated as the de facto global baseline for privacy programs.

Virginia privacy statute establishing consumer rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, sale, and certain profiling, together with controller obligations for purpose limitation, data minimization, and data protection assessments, enforced exclusively by the Virginia Attorney General with no private right of action.

Consumers have the right to request deletion of personal information collected from them.

Article 17 is the most recognized provision of the GDPR (General Data Protection Regulation) outside privacy-professional circles — the "right to be forgotten." It gives individuals the right to have their personal data erased without undue delay when one of several grounds applies: the data is no longer necessary for the purpose it was collected for, consent has been withdrawn and there's no other lawful basis, the individual objects and there's no overriding legitimate ground, the data was processed unlawfully, or erasure is required to comply with a legal obligation. The right is not absolute — Article 17(3) preserves processing where necessary for freedom of expression, legal compliance, public interest archiving, or the establishment/defense of legal claims — but where it applies, "without undue delay" sets a real operational clock, generally understood within the same one-month window as other data subject rights under Article 12. Critically, if the data has been made public, the controller must also take reasonable steps, including technical measures, to inform other controllers processing that data that the erasure has been requested. Ultimately, Article 17 is why "right to delete" has become the shorthand the public uses for data privacy generally — it is the right most closely tied to the felt sense of control over one's own digital footprint, and the one whose mishandling generates the most reputational damage when a company claims to have deleted data and later turns out not to have.

Section 59.1-577 bundles together the core set of consumer rights that most people think of when they picture "modern privacy law": the right to confirm whether a controller is processing your personal data and to access that data, the right to correct inaccuracies, the right to delete personal data you provided or that a controller obtained about you, and the right to obtain a portable copy of your data in a readily usable format so you can take it elsewhere. Together these four rights form the operational backbone of the statute. What distinguishes Virginia's approach is its restraint relative to California's original CCPA (California Consumer Privacy Act) text. There is no separate "right to know specific pieces of information collected over the past twelve months" style of granular disclosure obligation layered on top; the rights are more consolidated and, in practice, somewhat less operationally granular for the controller to fulfill, though no less real for the consumer exercising them. Ultimately, this section operationalizes the basic premise that data belongs, in a meaningful sense, to the person it describes. A controller is a steward, not an owner, and these four rights are the mechanism by which that stewardship is kept honest and answerable to the individual on the other end of the record.

The entity limits the use of personal information to the purposes identified in the notice and for which the data subject has provided implicit or explicit consent, retains personal information for only as long as necessary to fulfill the stated purposes or as required by law or regulation, and disposes of, destroys, or de-identifies personal information when no longer needed.

AICPA (American Institute of Certified Public Accountants), publisher of the SOC (Service Organization Control) family of attestation frameworks — including the SOC 2 Trust Services Criteria — that independent CPA (Certified Public Accountant) firms use to examine and report on a service organization's controls over security, availability, processing integrity, confidentiality, privacy, cybersecurity risk management, and supply chain risk management.

A voluntary attestation framework administered by the American Institute of Certified Public Accountants (AICPA) under which an independent CPA (Certified Public Accountant) firm examines and reports on the suitability of design and operating effectiveness of an entity's controls relevant to one or more Trust Services Categories: Security (the mandatory Common Criteria present in every report), Availability, Processing Integrity, Confidentiality, and Privacy. Unlike a prescriptive regulatory checklist, SOC (Service Organization Control) 2 is criteria-based — the entity designs its own controls to meet the Trust Services Criteria and the resulting Type I (point-in-time) or Type II (operating effectiveness over a review period) report is typically shared under an NDA (Non-Disclosure Agreement) with customers and prospects as evidence of a mature control environment.

Defines how long specific categories of data (customer data, Controlled Unclassified Information (CUI), financial records, logs) must be retained to meet legal/contractual obligations, and the secure disposal methods required once that period expires. Distinct from the Document Control & Retention Policy in that it governs raw data and datasets rather than controlled documents; satisfies National Institute of Standards and Technology (NIST) SP 800-171 3.8.3 and International Organization for Standardization (ISO) 27001 Annex A 8.10.

The operational procedure for handling a verified consumer deletion/erasure request end to end: identity verification, timeline, propagation across systems and processors, and the secure-disposal method used, satisfying California Consumer Privacy Act (CCPA) §1798.105 and General Data Protection Regulation (GDPR) Article 17.