---
title: "Vermont privacy law: processors"
canonical: "https://dposchool.com/state-privacy-laws/state/vermont/processors"
source: "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Vermont Data Privacy and Online Surveillance Act

# Vermont privacy law: processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Processors must follow controller instructions and help with consumer requests, security and breach notification, and assessments. A binding contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations. It must also require confidentiality, deletion or return at the end, compliance information on request, and subcontracting only after the controller can object and under a written flow-down contract. Processors must provide assessment reports on request.

## Key points

1. Processors must follow instructions and assist with requests, security, breach notification and assessments.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415f(a)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

2. Binding contract with instructions, nature and purpose, data types, duration and rights and obligations of both parties.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415f(b)(1), (2)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

3. Contract must require confidentiality and deletion or return at the end, unless the law requires retention.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415f(b)(3)(A), (B)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

4. Subcontractors only after the controller can object, under a written contract with the same obligations.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415f(b)(3)(D)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

5. Processor must provide an assessment report to the controller on request.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415f(b)(4)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

6. A processor that sets purposes and means becomes a controller for that processing.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415f(d)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

## Sources

- [Act 145 (S.71) as enacted, 2025-2026 session](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Vermont statute](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

Reference material, not legal advice.

## Other topics for Vermont

- [Applicability](https://dposchool.com/state-privacy-laws/state/vermont/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/vermont/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/vermont/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/vermont/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Vermont](https://dposchool.com/state-privacy-laws/state/vermont) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/vermont/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/vermont/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents