What a Vermont business has to have in writing

Send the Attorney General a preliminary breach notice within 14 business days of discovery (DFR instead for DFR-regulated firms), then written notice to affected residents within 45 days. A business that has pre-filed a sworn affirmation that it keeps written security and breach-response policies may instead notify the AG shortly before it notifies consumers.

Register with the Secretary of State each January (fee, contact details, opt-out practices and the prior year's breach count) and maintain a written information security program with administrative, technical and physical safeguards sized to the business and the data it holds.

Publish a privacy notice covering categories, purposes, sharing, consumer rights and whether data is used to train large language models; record data protection assessments for targeted advertising, data sales, risky profiling and sensitive data; obtain opt-in consent before processing sensitive data; honor access, deletion, correction, portability, third-party-list and opt-out requests, including universal opt-out signals.

Treat unique biometric data generated from measurement or technical analysis of body characteristics, which the Attorney General reads to cover fingerprints, retina and iris images, facial and voice recognition and behavioural identifiers such as gait or typing pattern, as personally identifiable information. Exposure of it triggers the breach notice route: tell affected consumers without unreasonable delay and no later than 45 days, and preliminarily notify the Attorney General within 14 business days of discovery. The Attorney General also treats a failure to maintain adequate data security around that information as a Consumer Protection Act violation, so the safeguards need to be written down and followed.

Adopt a written sexual harassment policy that states harassment and retaliation are unlawful, explains how to complain internally and to the state, and describes consequences; give every employee a personal copy at hire and whenever it changes; post the state sexual harassment poster. Training is encouraged but not mandated.

Follow the standards VOSHA adopts (federal standards plus Vermont-specific rules such as stricter exposure limits), display the VOSHA job safety poster and the Safety Records poster, keep injury and illness logs, and report fatalities and hospitalizations to VOSHA. Vermont does not require a general written safety program beyond the federal-equivalent standards, though VOSHA publishes a program guide.

Write and implement a security plan for preventing workplace violence and managing aggressive behavior, developed with an advisory team of direct-care staff, the regional designated agency and law enforcement; review it annually, distribute it to employees, volunteers, the board and partners; run an incident reporting and tracking system; do not retaliate against reporters.

Keep a written information security program built on a risk assessment, with third-party oversight and incident response; file a written certification of compliance with DFR by April 15 each year and keep the supporting records for five years; report breaches to DFR under the Security Breach Notice Act.

Let employees accrue at least one hour of paid sick time per 52 hours worked (may be capped at 40 hours a year), post the Department of Labor earned sick time notice, and tell each employee about the law at hire, typically through a written sick leave policy.

Post the Department of Labor Parental and Family Leave notice at each worksite and give eligible employees up to 12 weeks of unpaid, job-protected leave in a 12-month period, plus short-term family leave.

Display the Department of Labor's current combined poster set (minimum wage, earned sick time, parental and family leave, pregnancy accommodations, sexual harassment, child labor, workers' compensation, unemployment, VOSHA and safety records) where employees can see it.

State a good-faith minimum and maximum salary or hourly wage in every job advertisement; say when a job is tipped and give its base wage range; explain when a commission-based role cannot carry a range; answer current employees who ask for their own range.

File formation or foreign-registration documents (or an assumed business name) through the Online Business Service Center, name a registered agent, and file the annual or biennial report to stay in good standing.

Register with the Office of Professional Regulation (annual fee; $1M/$2M liability insurance proof), renew each year, and use a written contract with the homeowner that states the price structure, scope, start and finish dates and change-order terms.

Obtain a Department of Health license before opening and renew it annually, pass inspections, and designate a person in charge who can demonstrate food safety knowledge to inspectors. Vermont recommends but does not mandate a certified food protection manager credential.

Give everyone tested a written drug-testing policy that spells out when tests may be required, the procedures, the substances screened, how prescription and over-the-counter drugs are handled, and the consequences of a positive result. Current employees may be tested only on probable cause and with an employee assistance program available; applicants only with advance written notice after a conditional offer.

Post the Department of Labor 'Accommodations for Pregnant Employees' notice and provide reasonable accommodations for pregnancy-related conditions; give nursing employees reasonable break time and a private, non-bathroom space to express milk for three years after a birth.