Vermont. Breach notification. Act
VT breach lawVermont data breach notification law (9 V.S.A. §§ 2430, 2435 (Security Breach Notice Act))
Partly verified
Medium confidence.Penalty figure from Vermont Consumer Protection Act.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Vermont residents to notify affected individuals after a security breach. Core timing rule: AG preliminary notice within 14 business days. Covered data: name plus SSN, government IDs, financial account numbers and codes, biometric, genetic and health data; online credentials.
- Key themes
- Unique features
Very short 14-business-day preliminary AG notice; credential-only breaches can be handled by prompting password resets.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Vermont requires the maintaining entity to notify the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- AG preliminary notice within 14 business days; individuals within 45 days of discovery; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Consumer Protection Act penalties up to $10,000 per violation
§3Dates
- Key dates
- Adopted
- In force
- S.110 (2020, eff. 2020-07-01) broadened PI and credentials
§4Text and authority
- Text
- Authoritative text legislature.vermont.gov
- Authority
- Vermont Attorney General
§5Where it applies
- Domestic law of
- Vermont
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty figure from Vermont Consumer Protection Act.