What a Vermont business has to have in writing

Send the Attorney General a preliminary breach notice within 14 business days of discovery, or when consumers are notified if that comes first (DFR instead for DFR-regulated firms), and notify affected consumers without unreasonable delay and within 45 days of discovery, by mail, by email or phone as the statute allows, or by substitute notice where it applies. A business that swore in writing before the breach, on the Attorney General's form, that it keeps written security and breach-response policies instead notifies the AG before it notifies consumers.

Register with the Secretary of State each January (fee, contact details, opt-out practices and the prior year's breach count) and maintain a written information security program with administrative, technical and physical safeguards sized to the business and the data it holds.

Applies to a business that, in the preceding calendar year, controlled or processed the personal data of at least 35,000 Vermont consumers or the sensitive data of at least 3,000, or offered the personal data of at least 3,000 for sale. Publish a privacy notice covering categories, purposes, sharing, consumer rights and whether data is used to train large language models; record data protection assessments for targeted advertising, data sales, risky profiling and sensitive data; obtain opt-in consent before processing sensitive data; honor access, deletion, correction, portability, third-party-list and opt-out requests, including universal opt-out signals.

Treat unique biometric data generated from measurement or technical analysis of human body characteristics and used by the owner or licensee of the data to identify or authenticate the consumer, which the Attorney General reads to cover fingerprints, retina and iris images, facial and voice recognition and behavioral identifiers such as gait, typing pattern or navigation pattern, as personally identifiable information. Exposure of it triggers the breach notice route: tell affected consumers without unreasonable delay and no later than 45 days, and preliminarily notify the Attorney General within 14 business days of discovery, or when consumers are notified if that comes first. When the Attorney General investigates a breach notice violation, the office also asks whether the business had adequate data security, and treats a failure there as a Consumer Protection Act violation.

Adopt a written sexual harassment policy that states harassment and retaliation are unlawful, describes it with examples, sets out the range of consequences, and explains how to complain to the state and federal enforcement agencies; an employer with more than five employees also names the people who take internal complaints and describes that process. Give every employee an individual written copy, new employees at hire and everyone again whenever the policy changes, and post a poster that covers at least those elements (the Department of Labor's model poster may be used). Training is encouraged but not mandated.

Follow the standards VOSHA adopts (federal standards adopted by reference, plus two Vermont-specific standards, on permissible exposure limits and lineworker safety), display the OSHA "Job Safety and Health: It's the Law" poster and the Safety Records poster, keep injury and illness logs, and report fatalities and hospitalizations to VOSHA. Vermont does not require a general written safety program beyond the federal-equivalent standards, though VOSHA publishes a program guide.

Let employees accrue at least one hour of paid sick time per 52 hours worked (an employer may limit use to 40 hours in a 12-month period), post the Department of Labor earned sick time notice, and tell each employee about the law at hire, typically through a written sick leave policy.

Post the Department of Labor Parental and Family Leave notice at each worksite and give eligible employees up to 12 weeks of unpaid, job-protected leave in a 12-month period, plus short-term family leave.

Display the Department of Labor's mandatory workplace posters, which its page lists as the 2026 combined set and: unemployment, accommodations for pregnant employees, child labor, crime victim, earned sick leave, healthcare whistleblower, employer's liability and workers' compensation, job safety and health (the OSHA poster), minimum wage, parental and family leave, safety records, sexual harassment, and workers' compensation reinstatement rights. Display them where employees can see them.

If you employ five or more people, state the good-faith minimum and maximum annual salary or hourly wage in every written advertisement for a Vermont job opening, including openings that current employees can apply for and remote jobs that mainly serve a Vermont office. A commission-paid job must say so and need not give a range. A tipped job must say so and give its base wage or range of base wages. General announcements and verbal announcements are not covered. Refusing to interview, hire or promote someone for asserting these rights is a violation.

File formation or foreign-registration documents (or an assumed business name) through the Online Business Service Center, name a registered agent, and file the annual or biennial report to stay in good standing.

Give everyone tested a written drug-testing policy that spells out when tests may be required, the procedures, the substances screened, a statement that over-the-counter medications and other substances may produce a positive test, and the consequences of a positive result. Current employees may be tested only on probable cause and with an employee assistance program available; applicants only with advance written notice after a conditional offer.

Post the Department of Labor 'Accommodations for Pregnant Employees' notice and provide reasonable accommodations for pregnancy-related conditions unless that would be an undue hardship; give nursing employees reasonable time, paid or unpaid, and a private space that is not a bathroom stall to express milk for three years after a birth, unless doing so would substantially disrupt operations.

Register with the Office of Professional Regulation before contracting with a homeowner for residential construction worth more than $10,000, renew the registration every two years, carry liability insurance of at least $1M per occurrence and $2M aggregate, and use a written contract with the homeowner, when the work is expected to be worth more than $10,000, that states the price structure, the scope of work and materials, expected start and completion dates, and how changes are approved. Engineers, architects and trades licensed by the Department of Public Safety are exempt when acting within their license.

Write and implement a security plan for preventing workplace violence and managing aggressive behavior, developed with an advisory team of direct-care staff, the regional designated agency and law enforcement; review it annually, distribute it to employees, volunteers, the board and partners; run an incident reporting and tracking system; do not retaliate against reporters.

Apply to the Department of Health for a license at least 30 days before opening, hold it before you operate, renew it annually, pass inspections, and designate a person in charge who can demonstrate food safety knowledge to inspectors. Vermont recommends but does not mandate a certified food protection manager credential.

Keep a written information security program built on a risk assessment, with third-party oversight and incident response; each insurer domiciled in Vermont files a written certification of compliance with the Commissioner (DFR) by April 15 each year and keeps the supporting records for five years; report breaches to DFR under the Security Breach Notice Act. A licensee with fewer than 20 employees, counting independent contractors, is exempt from the program requirements. A licensee that keeps an information security program under HIPAA and certifies its compliance to the Commissioner each year is treated as meeting them.