The law provides the public with a guarantee of transparency, limitation of purpose, and the right to access, rectify, eliminate, and transfer data. Organizations are required to conduct data protection assessments and obtain explicit consent for the processing of sensitive information.

The Virginia Attorney General is the one who is responsible for enforcing the act, and this is how Virginia has become the first state in the U.S. to promote the establishment of a new kind of comprehensive, rights-based privacy governance.