It is not required by law, but the risk is real. If a breach exposes sensitive data like Social Security numbers or payment card details, Virginia law requires you to notify the Attorney General and affected residents. Cyber liability helps cover notice, legal costs, and recovery.
https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/
