Law / United States / U.S. Virgin Islands
Disclosure of Breach of Security (Identity Theft and Privacy Protection)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A breach notification rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Notify an affected Virgin Islands resident without unreasonable delay after discovering that unencrypted personal information (a name combined with a Social Security number, driver's license number, or financial account number with its access code) was acquired without authorization.
- Where direct notice is impractical because of cost, the number of residents affected, or insufficient contact information, give substitute notice by email, a conspicuous website posting, and notice to major territory-wide media.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Any person or business that conducts business in the Virgin Islands and owns or licenses computerized personal information must disclose a breach of security to an affected territory resident without unreasonable delay following discovery, and Section 2208 imposes the identical duty on a Virgin Islands government agency.
Covered personal information is a resident's first name or initial and last name combined with an unencrypted Social Security number, driver's license number, or financial account, credit, or debit card number together with any required access code, and excludes information lawfully made available to the public through government records.
Where direct notice would cost more than $100,000, would reach more than 50,000 residents, or the covered entity lacks sufficient contact information, substitute notice by email, a conspicuous website posting, and notice to major territory-wide media satisfies the duty.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach