ShareAndGoShareAndGo

Data breach notification

Vermont data breach notification law

Vermont's Security Breach Notice Act is 9 V.S.A. § 2435, with its definitions in § 2430.

This page describes the versions of those sections in force on November 2, 2026. Replacement versions take effect on January 1, 2027 and were not read.

Two deadlines, one for the regulator first

WhoDeadline
ConsumersIn the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification
Attorney General, or the Department of Financial Regulation for entities it regulatesA preliminary description of the breach within 14 business days of discovery, or when consumers are notified if that is sooner

Vermont has no size threshold for the regulator. Any breach goes to the Attorney General, or to the Department of Financial Regulation for the entities it oversees.

The statute's own words for the general case are "All other data collectors or other entities subject to this subchapter shall provide notice of a breach to the Attorney General."

Because 14 business days is shorter than 45 days, the regulator often hears first.

Personally identifiable information and login credentials

The definition joins a first name or initial and last name with "one or more of the following digital data elements, when the data elements are not encrypted, redacted, or protected by another method that renders them unreadable or unusable by unauthorized persons".

Those elements are wide: a Social Security number; a driver's license, state ID, taxpayer ID, passport, military ID or other government ID number; a financial account or card number usable without more or with its password, PIN or access code; unique biometric data; genetic information; and health records, wellness program records, medical diagnosis or treatment, or a health insurance policy number.

Login credentials are defined separately: a "user name or e-mail address, in combination with a password or an answer to a security question, that together permit access to an online account."

When consumer notice is not required

Consumer notice "is not required if the data collector establishes that misuse of personally identifiable information or login credentials is not reasonably possible".

That is not a quiet decision. The data collector must give the Attorney General, or the Department of Financial Regulation, notice of the determination with a detailed explanation.

Where ShareAndGo fits

Burlington accountants and Montpelier clinics often send tax IDs, wellness records or passport copies to people outside the firm.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

That watermark is a per-room setting, on by default. Outside readers verify a six-digit code sent to their email and need no account, and NDA acceptance before entry is available on Professional and Business. The chained log exports as CSV.

Vermont, answered

Is genetic information covered?
Yes. Genetic information is one of the listed data elements.
Is there a minimum number of affected people before the regulator hears?
No. Any breach goes to the Attorney General, or the Department of Financial Regulation for the entities it regulates.
What is the preliminary description deadline?
Within 14 business days of discovery, or when consumers are notified if that comes sooner.
Will this page change in 2027?
The sections take new versions on January 1, 2027, which this page has not yet read.

Scope of this page

Checked against Vermont's published law on November 2, 2026. This is general information, not legal advice.

Related

Breach notification laws by state

Breach rules for every state and territory.

ShareAndGo vs DataRooms.com

Two data rooms compared.

ShareAndGo home

ShareAndGo home.