Security Breach Notice Act

Requires businesses and other data collectors to tell Vermont consumers about a breach of their personally identifiable information or login credentials within 45 days of discovery, and to give the Attorney General (or DFR) a preliminary report within 14 business days. Notices must contain specified content, and large breaches require notice to the national credit bureaus.