1. Home
  2. State breach laws
  3. Vermont

Vermont data breach notification law

What Vermont requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by 9 V.S.A. §§ 2430 and 2435 (Security Breach Notice Act).

45 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Vermont's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Vermont breach filings →

Requirements in detail

Statute
9 V.S.A. §§ 2430 and 2435 (Security Breach Notice Act)
Deadline to notify residents
In the most expedient time possible and without unreasonable delay, but no later than 45 days after discovering or being notified of the breach. Notice must be delayed if law enforcement requests it, and timing may also account for measures needed to determine the scope of the breach and restore system integrity.
Attorney General notification
Yes, for every breach, regardless of how many residents are affected. Within 14 business days of discovery (or when residents are notified, if sooner), the business must give the Attorney General a preliminary notice with the breach date, the discovery date, and a description. Entities regulated by the Department of Financial Regulation notify that department instead. When residents are notified, the business must also send the number of Vermonters affected and a copy of the notice. Consumer reporting agencies must be notified when more than 1,000 consumers are notified at one time.
Penalties
The Attorney General and State's Attorneys have sole authority to enforce the law, using the Consumer Protection Act, which allows civil penalties of up to $10,000 for each unfair or deceptive act or practice. The Department of Financial Regulation enforces the law against the entities it licenses or registers.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Vermont's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Vermont has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
Act 138 of 2026 (H.211) amends the Security Breach Notice Act effective January 1, 2027. Telephone notice will require at least five attempts to reach the consumer live before leaving a voicemail. Entities covered by HIPAA will be deemed compliant only if they also notify the Attorney General or the Department of Financial Regulation and certify compliance with the federal breach rule. The act also creates a separate Data Broker Security Breach Notice Act requiring data brokers to notify affected consumers within 45 days and the Attorney General within 14 business days.

Vermont breach notification FAQ

What is the data breach notification deadline in Vermont?

In the most expedient time possible and without unreasonable delay, but no later than 45 days after discovering or being notified of the breach. Notice must be delayed if law enforcement requests it, and timing may also account for measures needed to determine the scope of the breach and restore system integrity. The governing law is 9 V.S.A. §§ 2430 and 2435 (Security Breach Notice Act).

Does Vermont require notifying the Attorney General of a data breach?

Yes, for every breach, regardless of how many residents are affected. Within 14 business days of discovery (or when residents are notified, if sooner), the business must give the Attorney General a preliminary notice with the breach date, the discovery date, and a description. Entities regulated by the Department of Financial Regulation notify that department instead. When residents are notified, the business must also send the number of Vermonters affected and a copy of the notice. Consumer reporting agencies must be notified when more than 1,000 consumers are notified at one time.

What are the penalties for failing to report a data breach in Vermont?

The Attorney General and State's Attorneys have sole authority to enforce the law, using the Consumer Protection Act, which allows civil penalties of up to $10,000 for each unfair or deceptive act or practice. The Department of Financial Regulation enforces the law against the entities it licenses or registers.

Can individuals sue over a data breach in Vermont?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Vermont?

Vermont's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Vermont limit breach lawsuits for companies with a cybersecurity program?

No. Vermont has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Vermont Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →