Skip to content

Cyber Liability by state

Vermont data breach notification law and cyber insurance

Direct answer

What is Vermont's data breach notification law?

Vermont's breach notification law (Vt. Stat. tit. 9, sect. 2430 et seq.) requires businesses to notify affected residents in the most expedient time possible and without unreasonable delay, but not later than 45 days after discovery of the breach after a breach of personal information.

Reviewed by Cornerstone Staff28 years of financial services state licensing experienceLast verified July 29, 2026

What the statute requires

Vermont requires businesses to notify affected residents within 45 days of discovering a breach and to give the Attorney General a preliminary notice within 14 business days. Cyber liability insurance typically covers the forensics, notification, and legal review these overlapping deadlines demand.

Consumer notification deadline
In the most expedient time possible and without unreasonable delay, but not later than 45 days after discovery of the breach
Regulator notice
Notify the Vermont Attorney General within 14 business days of discovering the breach, with a preliminary notice, and provide a copy of the consumer notice.
Credit bureau notice
Notify consumer reporting agencies when a breach requires notice to more than 1,000 residents.
Safe harbor
Notification is not required if the compromised data was encrypted, or where an investigation finds misuse of the information is not reasonably possible.
Enforcement
Violations are enforceable by the Attorney General under the state's consumer protection law.

Statutes and sources

  • Vermont Security Breach Notice Act

    Vt. Stat. tit. 9, sect. 2430 et seq.

Regulator: Vermont Attorney General . Last verified 2026-07-29 from the official source .

Get Vermont coverage handled

Share a few details and an agent will respond within one business day.