Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Vermont |
|---|---|
| Statute citation | 9 V.S.A. §§ 2430, 2435 (Security Breach Notice Act) (amended 2020) |
| Individual notice timing | 45 days Vermont requires businesses to notify affected consumers in the most expedient time possible |
| Attorney general notice | Yes Vermont requires notification to the Attorney General (or Department of Financial Regulation for |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | Not extracted in our PRC 2026 summary; check the statute. |