Certified Information Privacy Professional – United States (CIPP/US) — Question 178

Under what conditions will personal data processing be subject to the Virginia Consumer Data Protection Act (VCDPA) requirements for a documented data protection assessment?

Answer options

• A. If the data subject is younger than 13 years of age and the data is processed after January 1, 2023.
• B. If the data processor processes personal data beyond the controller's instructions.
• C. If the personal data is stored by a California-based third-party service provider.
• D. If the personal data is processed for purposes of targeted advertising.

Correct answer: D

Explanation

The correct answer is D because the VCDPA specifically requires a documented data protection assessment when personal data is processed for targeted advertising. Options A, B, and C do not meet the criteria set forth by the VCDPA for requiring such an assessment.