Vermont Data Breach Notification Letters

Vermont Security Breach Notice Act (9 V.S.A. § 2435) & Consumer Protection Act

Vermont has one of the most comprehensive breach laws in the country, requiring notification within 45 days and — uniquely — requiring companies to report annually to the AG's office on data security practices. Vermont courts have recognized that delayed notification itself is an independently actionable harm.

Vermont residents benefit from annual AG oversight of company security practices — creating a paper trail that strengthens civil claims. Vermont courts have held that being deprived of timely notice is itself a compensable harm.