Virginia Code § 59.1-579 — Consumer-data processors and contractual controls

AI-use reference. Current. Applies to: Covered controllers/processors Requirements or purpose: Processors must assist controllers with requests, security, breach and assessment obligations. Contracts must state instructions, purpose, data types, duration, confidentiality, deletion/return, compliance information, subcontractor obligations and assessment provisions. Limits: § 59.1-576 exempts state/local governmental bodies, HIPAA entities/business associates, specified financial entities/data, nonprofits and higher education; numerous data exemptions also apply. Not a city-wide AI regulation; applicability to a private supplier depends on its activities and exemptions.