The New Hampshire Data Privacy Act applies to businesses that control or process personal data of at least 35,000 New Hampshire consumers, or 10,000 consumers if more than a quarter of revenue comes from selling personal data.
What the New Hampshire Data Privacy Act Requires
It follows the Connecticut model: a clear privacy notice, rights to access, correct, delete, and port personal data, opt-in consent for sensitive data, opt-outs from targeted advertising, sale, and significant profiling, and data protection assessments for higher-risk processing. Universal opt-out signals had to be honored starting January 1, 2025.
Enforcement and Penalties
The Attorney General enforces exclusively under the state consumer protection act. A guaranteed 60-day cure period ran through the end of 2025, and cure is now discretionary. Given the low thresholds and New Hampshire’s small population, regional businesses in New England can be covered more easily than they expect, so traffic and customer counts are worth checking.
Source: New Hampshire General Court: SB 255, RSA Chapter 507-H
Report a violation: If you believe a business is violating this law, you can file a complaint with the New Hampshire Department of Justice Consumer Protection and Antitrust Bureau.
