Vermont SaaS Agreement Review
Vermont argued over comprehensive privacy longer than most states. After a 2024 veto, Governor Scott signed S.71, now Act 145, on June 16, 2026, and it takes effect January 1, 2028. What already applies is distinctive: one of the first data broker registration laws in the country, and a breach statute that requires an early heads-up to the attorney general. A Burlington software firm should plan around all three.
Consumer privacy law in Vermont
Vermont Data Privacy and Online Surveillance Act (S.71), effective January 1, 2028Takes effect January 1, 2028
Not in force until January 1, 2028. Will generally apply at 35,000 Vermont consumers, or 3,000 for sensitive data or data sales; consumer health data rules have no threshold.
Data rights in Vermont
Vermont has enacted the Vermont Data Privacy and Online Surveillance Act (S.71), effective January 1, 2028, a comprehensive consumer privacy law that takes effect on January 1, 2028. Until then residents have no comprehensive statutory data rights, and the SaaS contract is your main protection. For a contract that runs past that date, ask the vendor to commit to a data-processing agreement that meets the new law.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What does Vermont's breach law require, and how quickly?
9 V.S.A. 2435 requires a business to send the attorney general a preliminary notice within 14 business days of discovering a breach, and to notify affected consumers in the most expedient time possible and no later than 45 days after discovery. A vendor that maintains data for you must notify you immediately after discovery. With a two-week clock, your SaaS contract needs a short incident reporting deadline and a duty to share facts as they emerge.
The attorney general publishes breach notices it receives, so an incident at a vendor can become public quickly. Vermont's definition of personal information also covers login credentials, which brings many SaaS account compromises within the statute.
Data brokers and vendor data use
Vermont requires data brokers, businesses that collect and sell personal information about consumers they have no direct relationship with, to register annually with the Secretary of State and meet security standards. If a SaaS vendor's terms let it combine or sell customer data, ask whether it is a registered broker and narrow that right before you sign.
Vermont's automatic renewal statute, 9 V.S.A. 2454a, protects consumers. Business buyers should set renewal and cancellation terms in the contract, including a written reminder before the notice deadline and cancellation by email.
Vermont sources checked 2026-10-09: Davis Wright Tremaine, Vermont breach summary · Hunton, Vermont enacts comprehensive privacy law · Vermont AG security breach notices. Laws change; confirm the current rule before relying on it.
Vermont SaaS agreement FAQ
Does Vermont have a data privacy law that affects SaaS contracts?
Not yet in force. Vermont has enacted the Vermont Data Privacy and Online Surveillance Act (S.71), effective January 1, 2028, but it takes effect on January 1, 2028. Until then there is no comprehensive state privacy law, so the SaaS contract itself is your main protection; for a multi-year contract, make sure the vendor will meet the new law when it starts.
Can a SaaS vendor use my Vermont business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Vermont law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Vermont?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Vermont law in about a minute.
What is the 14-day rule in Vermont's breach law?
Under 9 V.S.A. 2435, a business must give the attorney general a preliminary description of a breach within 14 business days of discovery, even before notifying consumers. Consumer notice follows within 45 days. Make sure your SaaS vendor must report incidents to you quickly enough to meet that early deadline.
Does Vermont have a comprehensive privacy law for SaaS buyers?
Not yet in force. S.71, signed as Act 145 in June 2026, takes effect January 1, 2028 and generally applies at 35,000 Vermont consumers. It requires processor contracts covering confidentiality, deletion and subprocessors. Until then, the contract is your main protection on data use and deletion.
Reviewing a SaaS contract in Vermont?
Upload it and get the data, liability, and renewal terms checked against Vermont law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Vermont law when you run your agreement, and you should confirm anything critical with a qualified attorney.