TerraTrue Launches Proactive Privacy Module for Virginia Consumer Data Protection Act

TerraTrue, an innovator in privacy, today announced the availability of its privacy platform module for the Virginia Consumer Data Protection Act (VCDPA), adding to its modules for GDPR and CCPA/CPRA compliance. With the VCDPA module enabled on its platform, TerraTrue activates an out-of-the-box taxonomy that provides intelligent rulesets and workflows for the VCDPA, and automatically analyzes the inputs from past product launches to power recommendations that ensure companies stay in compliance – without ever having to refer back to the law.

The VCDPA will be coming into effect on January 1, 2023. This means businesses must learn the law and assess the data types, data uses, and data processing activities within their organization’s operational processes and products to ensure their current practices can support the law before the new year.

“The new law has some key differences from the CPRA, CCPA, and GDPR that will require operational changes within the organization,’’ said Chris Handman, co-founder and COO of TerraTrue and former Snap General Counsel. “Companies should plan to take an inventory of the data they hold that may be considered ‘sensitive’ under the VCDPA, as well as the context in which it was collected or processed. They’ll need to update their privacy policies and assess existing products, features, and processing activities to see whether additional assessments may be required for targeted advertising, selling personal data, and processing activities involving personal data that present a heightened risk of harm to consumers. TerraTrue’s VCDPA module is purpose-built to expertly guide companies along the path to compliance.”

About the VCDPA
The VCDPA gives consumers the right to access their data, obtain a copy of their personal data, and request that their personal information be deleted by businesses. It also requires companies to conduct data protection assessments related to processing personal data for targeted advertising and sales purposes. The VCDPA applies to persons who “conduct business” in the Commonwealth or produce products or services that are “targeted” to residents of Virginia.

Entities conducting business in Virginia must satisfy one of two thresholds to fall within the statute’s scope, and both thresholds address a minimum number of affected consumers. Entities must control or process the personal data of at least 100,000 consumers in a calendar year, or the personal data of at least 25,000 consumers, while deriving over 50 percent of gross revenue from the sale of that data.

How TerraTrue’s VCDPA module helps companies get compliant:

TerraTrue automates gap analysis
TerraTrue’s structured data approach saves teams from the slow, inefficient, and error-prone process of manual gap analysis. Without it, they’ll have to dig through old privacy reviews by hand, examine them individually, and cross-check their privacy practices with the VDCPA’s new requirements. Even at smaller organizations, a full gap analysis can sprawl across thousands of pages of documentation that must be mapped and tracked across all of their databases and tools.

TerraTrue’s VCDPA module automates most of this work. Documenting existing data protocols is quick, taking just a few minutes for each privacy review. Then the platform automatically scans a company’s entire privacy program and creates a prioritized list of recommendations — the expert guided path to VCDPA compliance.

Run privacy reviews that get simpler over time
TerraTrue gets smarter the more teams use it, so completing privacy reviews for new products, features, and business initiatives gets simpler and more efficient over time. Does a business work with sensitive data types like citizenship, immigration status, or biometric data? Does it require users to create online accounts? Does the HR department retain contact information for job applicants or past employees? TerraTrue learns about a company’s privacy practices every time a privacy review is completed — meaning its recommendations get better and reviews get simpler as teams go.

Get real-time guidance on shifting regulations
TerraTrue helps teams stay on top of regulatory changes as they happen. TerraTrue’s VCDPA module is designed to account for incoming regulations, court decisions, and enforcement interpretations, so companies can stay up to date without getting bogged down in research. That means they’ll get the confidence of expert guidance without spending huge amounts of time and money deciphering and interpreting new rules.

Read more on our blog
To dive deeper into what’s changed with VCDPA – click here

Resources
Follow TerraTrue on LinkedIn
Follow TerraTrue on Twitter
We’re hiring – join the team
#ShiftLeftPrivacy

About TerraTrue
TerraTrue empowers teams to build privacy and security into everything they do through a collaborative, intuitive, and scalable platform. Purpose-built to work with modern product development, TerraTrue seamlessly captures structured data about how teams plan to collect, use, store, and share data. The platform then maps that digital blueprint to the world’s privacy laws to automate guidance, risk-flagging, and downstream data maps and reports. Sitting as a hub between product teams and review teams, TerraTrue also smartly routes rule-based workflows throughout an organization, automatically detects and reports infrastructure changes in cloud environments, and drives vendor management — all from the same single source of truth. With TerraTrue’s digital privacy platform, companies run a scalable, fast privacy-by-design program that eliminates spreadsheets, manual ad-hoc processes, and compliance bottlenecks. TerraTrue was founded in 2018 by former Snap execs and is backed by, among others, 3L Capital, Anthos Capital, and Chris Sacca. Modern brands like Lyft, Robinhood, Roku, and Foursquare use TerraTrue to get privacy right.

# # #

Contact Information

Brian Ferrario

Head of Global Marketing

TerraTrue

brian@terratrue.com