Virginia SaaS Agreement Review
Virginia wrote the template most state privacy laws copy. The Virginia Consumer Data Protection Act, in force since January 1, 2023, spells out what a processor contract must contain, and many national SaaS vendors' data processing addenda were first drafted to meet it. Virginia also has a detailed automatic renewal statute. A Northern Virginia government contractor or a Richmond healthcare group should check both against the vendor's paper.
Consumer privacy law in Virginia
Virginia Consumer Data Protection Act (VCDPA)
Data rights in Virginia
Virginia has enacted the Virginia Consumer Data Protection Act (VCDPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Virginia residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What must a Virginia processor contract contain?
The VCDPA applies at 100,000 Virginia consumers in a year, or 25,000 where more than half of gross revenue comes from selling personal data. Va. Code 59.1-579 requires a binding contract setting out instructions, the nature and purpose of processing, data types, duration and each party's rights. The processor must impose confidentiality on its staff, delete or return data at the end of service, provide compliance information, flow obligations down to subcontractors, and allow reasonable assessments or provide an independent assessor's report. The attorney general enforces the act, with a 30-day cure period and civil penalties of up to $7,500 per violation. Unlike Oregon's law, it exempts nonprofits.
How strict is Virginia's auto-renewal law?
Va. Code 59.1-207.46 requires clear disclosure and affirmative consent before charging, a retainable acknowledgment, and cancellation at least as easy as sign-up, including online cancellation for offers started online. For renewals of more than 12 months, the seller must send notice 30 to 60 days before the cancellation deadline. Free trials longer than 30 days need a reminder before they convert. The statute protects consumers; business buyers should negotiate similar terms.
Breach notice and tax
Va. Code 18.2-186.6 requires notice to the attorney general and affected residents without unreasonable delay. Virginia does not generally tax SaaS.
Virginia sources checked 2026-10-09: Va. Code 59.1-576 (scope) · Va. Code 59.1-579 (processors) · Va. Code 59.1-207.46 (automatic renewal). Laws change; confirm the current rule before relying on it.
Virginia SaaS agreement FAQ
Does Virginia have a data privacy law that affects SaaS contracts?
Yes. Virginia has enacted a comprehensive consumer privacy law, the Virginia Consumer Data Protection Act (VCDPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Virginia residents.
Can a SaaS vendor use my Virginia business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Virginia law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Virginia?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Virginia law in about a minute.
When must a seller remind Virginia consumers about an annual renewal?
For an automatic renewal that extends the contract by more than 12 months, Va. Code 59.1-207.46 requires notice 30 to 60 days before the cancellation deadline or end of term. The notice must disclose the renewal, the deadline, how to cancel and the renewal terms. A free trial over 30 days also needs a reminder before it ends.
Is a vendor's standard DPA enough under Virginia law?
Often, but check it. Va. Code 59.1-579 lists specific terms: instructions, purpose, data types, duration, confidentiality, deletion or return, compliance information, subcontractor flow-down and assessments. If the vendor's addendum omits any of them, or lets it use data for its own purposes, ask for changes.
Reviewing a SaaS contract in Virginia?
Upload it and get the data, liability, and renewal terms checked against Virginia law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Virginia law when you run your agreement, and you should confirm anything critical with a qualified attorney.