US CPRA CPRA vs Virginia Vcdpa

CPRA: define the exact products, services, processing, claims, entities, assets, or activities that bring this side into scope; record out-of-scope facts separately.

Virginia VCDPA: test its own scope boundary, exclusions, and covered activity; do not copy the CPRA conclusion without a separate source-linked finding.

Write two scope findings first: where CPRA applies, where Virginia VCDPA applies, and which facts are outside one side even if evidence can be reused.

CPRA: identify the covered business and any service provider, contractor, or third party that owns the California privacy duty.

Virginia VCDPA: identify the controller responsible for the duty and any processor acting on the controller's instructions.

Name each role separately because one entity can hold different obligations in different workflows.

CPRA: state the fact that starts the obligation, such as market placement, processing, designation, incident, reporting period, transfer, data request, supplier change, or public claim.

Virginia VCDPA is triggered only by the facts named in its source, such as thresholds, regulated status, risk tier, designation, incident, market placement, certification need, or supervisory notice.

Start with the trigger so teams do not apply the wrong regime to the wrong facts.

CPRA requires opt-out rights for sale and sharing, sensitive personal information restrictions, a right to correct, cybersecurity audits, risk assessments for certain processing, and enforcement through the California Privacy Protection Agency with a cure period eliminated for violations after January 1, 2023.

The Virginia VCDPA requires controllers to provide opt-out rights for targeted advertising, sale, and profiling in decisions producing legal effects, honor access, correction, deletion, and portability rights within 45 days, conduct data protection assessments for high-risk activities, and offer an internal appeal process before consumers can complain to the Attorney General.

Translate obligations into tickets, notices, records, controls, or contract terms.

CPRA: keep the evidence that proves this side of the decision, including cited text, registers, policies, test records, contracts, notices, reports, approvals, or audit artifacts.

Virginia VCDPA: keep comparator evidence in a distinct record set and link only the artifacts that genuinely satisfy both source-linked requirements.

Keep source links, factual analysis, owner approval, and implementation evidence together.

CPRA: capture the application date, commencement date, transition period, reporting clock, review cadence, remediation window, or certification renewal that controls this side.

Virginia VCDPA: track the comparator schedule separately so a later deadline, recurring audit, or incident timer is not hidden by the other workstream.

Use current source dates; do not reuse old project plans after amendments or guidance updates.

CPRA: identify the competent authority, regulator, assessor, customer audit, certification body, contractual remedy, penalty, or supervisory process tied to this side.

Virginia VCDPA: identify the comparator enforcement or assurance route and record where supervision, penalties, market access, certification, or contract leverage differs.

Escalate when enforcement routes differ because a regulator, market-surveillance authority, certification body, customer, or contract counterparty may require different proof.

CPRA: reuse controls only where the source-linked duty, evidence standard, owner, and timing align with the comparator; otherwise keep a bridge note.

Virginia VCDPA can reuse evidence from the other side only when the same fact pattern, system boundary, control, owner, and source-linked requirement are genuinely aligned.

Document overlap explicitly instead of merging both tests into one vague compliance label.

CPRA: treat this as the controlling workstream when its scope trigger, deadline, regulator, or required artifact is the immediate blocker.

Virginia VCDPA: run a parallel or follow-on workstream when this side adds separate actors, evidence, timing, penalties, customer assurances, or implementation constraints.

Choose one practical next step: proceed under CPRA, proceed under Virginia VCDPA, run both in parallel, or document why neither side controls the present fact pattern.