Law / United States / 
Vermont
Security Breach Notice Act
In force since .
A breach notification rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Notify an affected Vermont consumer of a security breach in the most expedient time possible and without unreasonable delay, and no later than 45 days after discovery.
- Notify the Attorney General or the Department of Financial Regulation, as applicable, of the date of the breach and the date of discovery, with a preliminary description of the breach, within 14 business days of discovering the breach or when you notify consumers, whichever is sooner (unless, having sworn to the Attorney General in writing before the breach that you maintain written security policies and procedures, you notify the Attorney General before notifying consumers).
These lines are LexLint's reading of the law's text. Also read by: Vermont Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Attorney General's guidance is dated June 2020.
- As of
- Guidance link
- https://ago.vermont.gov/wp-content/uploads/2020/07/2020-07-14-Security-Breach-Guidance.pdf
- Guidance body
- Vermont Office of the Attorney General
What it makes you log
What the log must hold
Actor identity
Logging duty
Where law enforcement asks a data collector to delay notice of a breach other than in writing, the collector must document the request contemporaneously in writing, with the name of the officer and the officer's agency. The rest of the section is notice: to consumers within 45 days, to the Attorney General or the Department of Financial Regulation within 14 business days, and a determination that misuse is not reasonably possible filed with a detailed explanation; the sworn statement of written security policies (b)(3)(B)(ii) states a policy and not a record. The section sets no retention period and names no one entitled to the documented request. The reach is the clause for a data collector that acts or conducts business in Vermont; the notice runs to the consumer, a term defined in 9 V.S.A. 2430(3), which the row does not cite.
- Kind
- Explicit
- As of
- Provision
- 9 V.S.A. sec. 2435(b)(4)(A)
- Trigger
- security_incident
What this law does
A data collector that owns or licenses computerized personally identifiable information or login credentials must notify an affected Vermont consumer of a security breach in the most expedient time possible and without unreasonable delay, but not later than 45 days after discovery. Notice to the Attorney General or the Department of Financial Regulation, as applicable, is faster, with a preliminary description due within 14 business days.
The source page's own history note dates original enactment to 2005, No. 162 (Adj. Sess.), sec. 1, effective , since amended in 2011, 2013 (twice), 2015, and 2019; the source page itself flags it as an unofficial online copy.
The enforcement subsection gives the Attorney General and State's Attorney sole and full authority to enforce a violation by a data collector not licensed or registered with the Department of Financial Regulation, with the remedies they hold under 9 V.S.A. chapter 63, Vermont's Consumer Fraud Act. The Attorney General's June 2020 Security Breach Notice Act Guidance states that the Act does not contain a private right of action. Act 145's own section 2415j, by contrast, expressly denies a private right of action for violations of that subchapter.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .