Data Breach Notice to Residents and State Authorities in Vermont
At a glance
| Covered entity and service provider | Data collector owning/licensing computerized PI or login credentials tells consumers; nonowner holder immediately tells owner/licensee after discovery (§§ 2430(6), 2435(b)(1)–(2)) |
|---|---|
| Breach and covered information | Actual/reasonably believed unauthorized electronic acquisition compromising PI or login credentials; PI includes name plus ID, financial, biometric, genetic or health data (§ 2430(9)–(10),(13)) |
| Risk screen or notice exception | No consumer notice if misuse not reasonably possible, with detailed regulator explanation; good-faith employee acquisition excluded (§§ 2430(13)(B), 2435(d)(1)–(2)) |
| Individuals who receive notice | Vermont consumers whose covered information or credentials were breached; nonowner holder alerts owner/licensee (§§ 2430(3), 2435(b)(1)–(2)) |
| Individual notice deadline and clock | Most expedient time without unreasonable delay, no later than 45 days after discovery/notification; law-enforcement delay and necessary scope/restoration work (§ 2435(b)(1),(4)) |
| Regulator threshold and deadline | AG or Department of Financial Regulation, no person-count threshold; preliminary breach/date report within 14 business days after discovery or by consumer notice, whichever sooner; later count/copy (§ 2435(b)(3)) |
| Consumer-reporting-agency notice | More than 1,000 consumers noticed at once: nationwide agencies receive timing, distribution and content without unreasonable delay; Title 8 licensees/registrants excluded (§ 2435(c)) |
| Individual delivery and content | Mail, qualifying email or direct live phone; clear notice with incident/data type, protections, contact, vigilance advice and approximate breach date if known; credentials-only routes (§ 2435(b)(5)–(6),(d)(3)–(4)) |
| Substitute notice conditions and channels | Lowest direct-method cost >$10,000 or insufficient contact; website if maintained AND major statewide and regional media (§ 2435(b)(6)(B)) |
| Delays and alternate compliance | Law-enforcement request delays until written withdrawal; limited HIPAA substitute and federal-guidance financial institution routes; no waiver (§ 2435(b)(4),(e)–(g)) |
Requirements one by one
Trigger and parties
Vermont § 2430(13) covers unauthorized acquisition or reasonable belief of acquisition of electronic data compromising personally identifiable information or login credentials. The § 2430(10) combinations include financial, biometric, genetic, and health details; § 2430(9) separately defines online-account credentials. Good-faith employee acquisition for a legitimate purpose is excluded when the information is neither misused nor further disclosed without authority.
An owner or licensee tells the affected Vermont consumer (§ 2435(b)(1)). A nonowner holder must tell the owner or licensee immediately after discovery, subject to the statute's law-enforcement delay (§ 2435(b)(2)).
Consumer and regulator clocks
Consumer notice under § 2435(b)(1) must be in the most expedient time possible without unreasonable delay, no later than 45 days after discovery or notification, allowing necessary investigation, restoration and law-enforcement needs. The attorney general receives the report for ordinary data collectors; a collector regulated by the Department of Financial Regulation reports there (§ 2435(b)(3)(A)).
Under § 2435(b)(3)(B), the regulator receives breach and discovery dates and a preliminary description within 14 business days of discovery or when consumers are notified, whichever is sooner. A collector that made the specified advance sworn policy filing with the attorney general may instead provide this information before consumer notice. When consumers are notified, the collector also sends the regulator the affected Vermont count, if known, and a copy of the consumer notice (§ 2435(b)(3)(C)). Login-credentials-only incidents trigger this regulator notice only if the credentials came directly from the collector or its agent (§ 2435(b)(3)(D)).
If more than 1,000 consumers receive notice at once, § 2435(c) requires the timing, distribution and content of notice to go to nationwide consumer reporting agencies without unreasonable delay, except for persons licensed or registered under Title 8 by the Department.
Delivery and exceptions
9 V.S.A. § 2435(b)(5) requires clear and conspicuous consumer notice describing the incident, data type, protective acts, phone contact, vigilance advice and approximate breach date, when known. 9 V.S.A. § 2435(b)(6) allows mail, qualifying email or direct live telephone notice. Substitute notice is available if the cheapest direct method costs more than $10,000 or contact information is insufficient; it combines website posting if maintained and major statewide and regional media.
Under § 2435(d)(1), a collector may withhold consumer notice if it establishes that misuse is not reasonably possible and gives the attorney general or financial regulator a detailed explanation. Later facts showing misuse require consumer notice under § 2435(d)(2). Credential-only breaches use the special account-protection methods in § 2435(d)(3)–(4).
What trips people up
The law-enforcement delay needs a documented request and written release. 9 V.S.A. § 2435(b)(4) lets an agency request delay for investigation, public-safety or national-security reasons; an oral request must be contemporaneously documented, and the agency must later withdraw it in writing. Notice then proceeds without unreasonable delay.
An enacted change is scheduled for 2027. 2026 Act 138 § 1 amends Chapter 62, including § 2435; § 5(a) sets January 1, 2027 for that amendment. The rules above are the current compiled law as of October 14, 2026.
Common questions
May email be used for ordinary breach notice?
Yes, under § 2435(b)(6)(A)(ii) when the collector has a valid address and meets the section's primary-electronic-communication safeguards or E-SIGN requirements.
Does federal health-privacy compliance always replace Vermont notice?
No. 9 V.S.A. § 2435(e) limits its compliance route to the specified health information and federal breach notice. 9 V.S.A. § 2435(g) separately addresses financial institutions under specified federal guidance.
Statutes and sources
- 9 V.S.A. § 2430 — definitions and covered information.
- 9 V.S.A. § 2435 — consumer, regulator and agency notice.
- 2026 Vt. Act 138 §§ 1, 5 — enacted future amendment and effective date.
Current official statute and enacted act checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Vermont law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Vermont law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace