Vermont Data Breach Notification Law

The Vermont data breach notification law: deadlines and data

9 V.S.A. § 2435 puts the state ahead of the public: any breach, however small, needs a preliminary Attorney General notice within 14 business days, well inside the 45 days consumers can wait ¹.

The protected list is long. On top of name with a Social Security or license number, it covers ²:

• Online account credentials, and a financial account password or PIN
• A financial account number on its own
• Passport and military ID numbers, and taxpayer ID numbers
• Biometric and genetic data
• Medical and health insurance information

Service providers that hold a client's records must tell that client of a breach ¹.

The 14-business-day Attorney General notice

The count is business days, starting at discovery or at the consumer mailing, whichever is first ¹. DFR licensees and registrants file with that department instead. Once consumers are notified, a follow-up gives the number of Vermonters affected and a copy of the letter ¹.

One alternative exists. A business that swore to the Attorney General, before any breach, that it maintains written security policies may instead notify the AG at any point before consumers ¹. Those policies usually start life as a WISP, and the sworn statement has to be on file before the incident, not prepared once it happens.

If more than 1,000 consumers are notified, the consumer reporting agencies must be told as well ¹.

Exceptions and login-credential breaches

Letters can be skipped only if the business establishes that misuse of the personal information or login credentials is not reasonably possible, and that determination, with a detailed explanation, goes to the Attorney General or the Department ¹. Either way, the state reads your reasoning.

Encrypted, redacted or otherwise unreadable data elements are not covered ².

Breaches of login credentials alone have their own rules. Notice can be sent electronically, but not through an email account that was itself breached, and the AG notice applies only if the credentials were taken directly from the business or its agent ¹.

Financial institutions covered by federal interagency guidance are exempt but must notify the Department of Financial Regulation as soon as possible ¹. The Attorney General and State's Attorneys enforce the law with their consumer protection powers, and individuals have no private right to sue under it ¹.

The 2027 change and first steps

Act 138 of 2026 (H.211), signed June 16, 2026, amends the law effective January 1, 2027 ³. A name will no longer be needed when a listed data element alone is enough to attempt identity theft, and a new section sets breach rules for data brokers. The current rule applies until then ³.

Facing a breach today, an insured Vermont business calls its carrier first, files with the FBI via ic3.gov, and copies evidence before restoring anything ⁴⁶⁵. Next, a containment specialist or your IT support firm stops it, the policy's rules on counsel apply (what carriers typically require), and two dates go on the calendar: business day 14 and day 45. New Hampshire or New York customers bring their own laws; all state rules are in our comparison table.

Title 9, including the Act 138 amendments, was checked for this page on October 13, 2026. This summary is not legal advice; a Vermont lawyer should confirm your obligations under both the current text and the 2027 version.