Bill S.93, introduced by Senators Chittenden, Beck, Cummings, Mattos, and Ram Hinsdale, seeks to establish the Vermont Data Privacy Act, which aims to enhance data privacy protections for Vermont residents. The bill introduces a new chapter, 9 V.S.A. chapter 61A, defining key terms such as "personal data," "consumer," "controller," and "sensitive data." It outlines consumer rights regarding personal data, including the necessity for clear consent before processing and conditions for selling or sharing data. The legislation applies to businesses handling significant amounts of consumer data and emphasizes the protection of sensitive information, particularly health-related data.

The bill also details the responsibilities of data controllers and processors, mandating compliance with consumer rights, including the ability to confirm data processing, correct inaccuracies, and opt out of certain activities. It requires data protection assessments for high-risk processing activities initiated after July 1, 2025, and establishes enforcement mechanisms through the Attorney General, who will address violations and provide a 60-day cure period for compliance. Additionally, the bill amends the Securities Exchange Act of 1934 to include new definitions and categories of entities, with an effective date of July 1, 2026, allowing time for affected entities to adapt to the new regulations.