West Virginia Data Breach Notification Laws: Reporting Rules & Timelines (2026)

West Virginia requires data breach notification without unreasonable delay under W. Va. Code 46A-2A-102. No fixed day count applies; businesses must act promptly after discovering a breach, with limited delays permitted for investigation or active law enforcement requests.

West Virginia's data breach notification law takes a comparatively narrow approach. Unlike states that have expanded their definitions to cover biometric data, medical records, and login credentials, West Virginia protects only the three most traditional categories of personal information. The law also lacks a fixed notification deadline, instead using the "without unreasonable delay" standard, and does not require any notification to state agencies.

The statute is codified at W.Va. Code 46A-2A-101 (definitions) through 46A-2A-105. Originally enacted in 2008, the law has not been significantly amended since its passage, making it one of the older and less updated breach notification statutes in the country.

For a broader look at West Virginia's privacy framework, see the parent guide to West Virginia Data Privacy Laws.

Who Must Comply

West Virginia's breach notification law applies to any individual or entity that owns or licenses computerized data that includes personal information about West Virginia residents.

This covers businesses of all sizes, nonprofit organizations, and any other entity that maintains a database of personal information. There is no minimum size threshold or revenue requirement.

Third-party service providers are also covered. Any entity that maintains computerized data on behalf of another entity must notify the data owner or licensee when a breach is discovered. The data owner then bears responsibility for consumer notification.

Notably, the law applies to entities that maintain data "as part of a database of personal information regarding multiple individuals." This language suggests that an entity holding personal information about only a single individual may not be subject to the notification requirements.

What Qualifies as Personal Information

West Virginia's definition of personal information is among the narrowest in the country. Under 46A-2A-101, personal information means a resident's first name or first initial and last name combined with any one or more of the following unencrypted, unredacted data elements:

• Social Security number
• Driver's license number or state identification card number
• Financial account number, credit card number, or debit card number combined with any required security code, access code, or password that would permit access to the resident's financial accounts

That is the complete list. West Virginia does not include biometric data, medical records, health insurance information, passport numbers, military IDs, login credentials, or any of the other expanded categories that many states have adopted in recent years.

Personal information does not include information lawfully obtained from publicly available records or from federal, state, or local government records lawfully made available to the general public.

What Triggers the Notification Requirement

A "breach of the security of a system" under West Virginia law means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information.

West Virginia imposes a dual trigger before notification is required:

1. Unauthorized access and acquisition: Both elements must be present. Mere unauthorized access without acquisition, or acquisition without unauthorized access, does not trigger the statute.

2. Risk of harm: The breach must cause the entity to "reasonably believe that the breach of security has caused or will cause identity theft or other fraud to any resident of this state."

This risk-of-harm analysis gives entities significant discretion. If an entity determines after investigation that a breach is unlikely to result in identity theft or fraud, notification is not required. However, the entity should document its analysis in case it is later questioned.

Good-faith acquisition of personal information by an employee or agent of the entity does not constitute a breach, provided the information is not used for an unauthorized purpose or subject to further unauthorized disclosure.

Notification Timeline

West Virginia requires notice "without unreasonable delay" following discovery or notification of the breach.

There is no specific day count. This open-ended standard is less prescriptive than states like Colorado (30 days) or Vermont (45 days), but it also provides less clarity for organizations trying to plan their incident response.

The statute does allow a reasonable delay for two purposes:

• Investigation: An entity may delay notification to take measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system.
• Law enforcement: If a law enforcement agency determines that notification will impede a criminal or civil investigation, or jeopardize national or homeland security, the entity may delay notification. Notice must be given without unreasonable delay after the agency determines notification will no longer compromise the investigation.

What the Consumer Notice Must Include

West Virginia's statute does specify content requirements for breach notification letters. Under W. Va. Code 46A-2A-102(d), the notice must include:

• To the extent possible, a description of the categories of information reasonably believed to have been accessed or acquired, such as Social Security numbers, driver's license or state ID numbers, and financial data
• A telephone number or website address the individual can use to contact the entity and learn what information it maintained about them
• The toll-free contact telephone numbers and addresses for the major credit reporting agencies, and information on how to place a fraud alert or security freeze

The Federal Trade Commission additionally recommends that breach notifications describe the incident itself, the steps the entity has taken, and recommendations for the consumer such as credit monitoring. Following these additional best practices, beyond what the statute requires, reduces litigation risk and demonstrates good faith.

No Attorney General Notification

West Virginia does not require notification to the Attorney General or any other state agency when a data breach occurs. This makes it one of a shrinking number of states that do not require government notification.

Consumer Reporting Agency Notification

If a breach requires notification to more than 1,000 people, the entity must also notify the nationwide consumer reporting agencies (Equifax, Experian, and TransUnion) without unreasonable delay.

The notice to the credit bureaus must include the timing, distribution, and content of the consumer notification. The purpose is to prepare the agencies for an influx of fraud alert and credit freeze requests.

This duty has a statutory carve-out. The final sentence of W. Va. Code 46A-2A-102(f) provides that the subsection does not apply to an entity subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq. A GLBA-covered financial institution therefore still notifies affected individuals but does not owe the credit-bureau notice, no matter how many people it notifies.

Methods of Notification

West Virginia allows notification through several methods:

• Written notice sent to the most recent postal address in the entity's records
• Telephonic notice (direct phone call)
• Electronic notice (email), if the entity has an email address for the consumer and the notice is consistent with federal requirements under the E-SIGN Act

Substitute Notice

West Virginia allows substitute notice when direct notification is not feasible. Under 46A-2A-101(7)(D), the qualifying conditions are joined by "or," so an entity may use substitute notice if it demonstrates any one of the following:

• The cost of providing direct notice would exceed $50,000
• The affected class to be notified exceeds 100,000 people
• The entity does not have sufficient contact information

Substitute notice must include any two of the following: email notification (if email addresses are available), conspicuous posting on the entity's website, or notification to major statewide media.

Encryption Safe Harbor

West Virginia provides an encryption safe harbor. The general notification duty in 46A-2A-102(a) reaches only "unencrypted and unredacted" personal information, so data that was encrypted or redacted at the time of the breach ordinarily does not trigger notice.

The safe harbor is not absolute. Under W. Va. Code 46A-2A-102(b), an entity must still give notice if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key, and the entity reasonably believes the breach has caused or will cause identity theft or other fraud. Encryption protects only for as long as the data stays encrypted and the key stays out of the intruder's hands.

The statute defines "redact" as alteration or truncation of data such that no more than the last four digits of a Social Security number, driver's license number, state ID number, or account number is accessible.

Enforcement and Penalties

The West Virginia Attorney General has exclusive authority to bring enforcement actions under the breach notification law, subject to one statutory exception. Violations are treated as unfair or deceptive acts or practices under the West Virginia Consumer Credit and Protection Act.

That exception is for regulated financial institutions. W. Va. Code 46A-2A-104(a) and (b) each open with "Except as provided by subsection (c)," and subsection (c) states that a violation of the article by a licensed financial institution "shall be enforceable exclusively by the financial institution's primary functional regulator." For those entities the enforcer is the banking or credit union regulator, not the Attorney General.

There is no private right of action. Individual consumers cannot sue directly for notification failures under this statute.

Penalties are subject to specific caps:

• No civil penalty may be assessed unless the court finds a course of repeated and willful violations
• Civil penalties cannot exceed $150,000 per breach or series of related breaches discovered in a single investigation

The $150,000 cap and the requirement to show repeated, willful conduct make West Virginia's penalty structure more lenient than most states. Single-incident failures, even if negligent, may not result in civil penalties.

More West Virginia Laws

• West Virginia Deepfake Laws
• West Virginia Employee Monitoring Laws
• West Virginia GPS Tracking Laws
• West Virginia Recording Laws