Vermont Data Privacy and Online Surveillance Act 2415f-b: 9 V.S.A. § 2415f(b)(1) to (4) Binding contract with required processor terms, subcontracting after an opportunity to object

A binding contract must govern the processing, setting instructions, nature and purpose, data types, duration and each party's rights and obligations, and require the processor to impose confidentiality on each person processing the data, delete or return data at the end of services unless law requires retention, make available information demonstrating compliance, engage subcontractors only by written contract meeting the processor's obligations and only after giving the controller an opportunity to object, and provide assessment reports on request.