Security Breach Notice Act

A data collector that owns or licenses computerized personally identifiable information or login credentials must notify an affected Vermont consumer of a security breach in the most expedient time possible and without unreasonable delay, but not later than 45 days after discovery.

Notice to the Attorney General or the Department of Financial Regulation, as applicable, is faster, with a preliminary description due within 14 business days, faster than New Hampshire's, Kentucky's, or Rhode Island's regulator-notice timelines in this batch. The source page's own history note dates original enactment to 2005, No. 162 (Adj. Sess.), sec. 1, effective January 1, 2007, since amended in 2011, 2013 (twice), 2015, and 2019; the source page itself flags as an unofficial online copy.

The enforcement subsection ties Attorney General and State's Attorney remedies to those they hold under 9 V.S.A. chapter 63, Vermont's Consumer Fraud Act, which independently grants consumers a private right of action for practices barred by section 2453; whether that cross-reference extends a private cause of action to a section 2435 notice violation, rather than only borrowing the state's own enforcement remedies, is not resolved by the text read and is left unset here, unlike the express private right of action in RSA 359-C:21 (New Hampshire) or the express denial in Act 145's own sec. 2415j.