Regulations › US states › New Hampshire
NHDPA
New Hampshire Data Privacy Act
WhenIn effect since 1 January 2025
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds35,000 unique consumers, or 10,000 consumers plus over 25% of gross revenue from selling perso…
Universal opt-outMust honor consumer-enabled opt-out preference signals for targeted ads and sale since January…
Cure period60-day cure mandatory through December 31, 2025
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $10,000 per violation under the Consumer Protection Act
Private actionNo private right of action under this chapter or any other law
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
2
35,000 unique consumers, or 10,000 consumers plus over 25% of gross revenue from selling personal data; payment-only data excluded.RSA 507-H:2, I · source ↗
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, listed nonprofits, higher education and government.RSA 507-H:3 · source ↗
Nonprofit exemption limited to certain 501(c) categories (RSA 507-H:1, XVIII).
Sensitive data and minors
Sensitive data
1
Opt-in consent to process sensitive data (health, sex life, orientation, immigration, genetic, biometric, known child, precise geolocation).RSA 507-H:1, XXVIII; 507-H:6, I(d) · source ↗
Children and teens
2
Child follows COPPA (under 13); ages 13 to 15 need consent for targeted ads or sale. From 2027, no sale of a child's data.RSA 507-H:6, I(d), (e-1), (g) · source ↗
2026 N.H. Laws 168:1 adds I(e-1), effective January 1, 2027.
Data minimization
1
Collection adequate, relevant and reasonably necessary for disclosed purposes.RSA 507-H:6, I(a) · source ↗
Consumers' rights
Rights
2
Access, correct, delete, portability, opt out of targeted ads, sale and automated profiling (7 rights).RSA 507-H:4, I · source ↗
Appeals
2
Internal appeal decided within 60 days; denial must give a way to contact the Attorney General.RSA 507-H:4, IV · source ↗
Universal opt-out
2
Must honor consumer-enabled opt-out preference signals for targeted ads and sale since January 1, 2025.RSA 507-H:6, V(a)(1)(B) · source ↗
Source note shows an amendment (2024, 229) with a date reference that reads 2026; check signal start date.
Business duties
Assessments
2
Required for targeted ads, sale, risky profiling and sensitive data; AG may require disclosure.RSA 507-H:8 · source ↗
Applies to processing created after July 1, 2024.
Processor contracts
3
Detailed terms, assessments or independent audit report, and subcontracting only after controller chance to object with equivalent written terms.RSA 507-H:7, II · source ↗
Privacy notice
2
Accessible notice with categories, purposes, rights, sharing, contact email, last-updated date; website opt-out link required.RSA 507-H:6, III-V · source ↗
Loyalty programs
2
Bona fide loyalty programs allowed; signal conflicts must follow the signal with option to confirm; financial incentive terms must be shown.RSA 507-H:6, II, V(a)(2), V(b) · source ↗
De-identified data
3
Public commitment, contract duties, oversight of recipients, and pseudonymous data exemption with separation.RSA 507-H:9 · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement; violations are unfair or deceptive practices under RSA 358-A:2.RSA 507-H:11 · source ↗
Cure period
1
60-day cure mandatory through December 31, 2025; discretionary from 2026.RSA 507-H:11 · source ↗
Maximum penalty
2
Up to $10,000 per violation under the Consumer Protection Act.RSA 507-H:11; RSA 358-A · secondary source · source ↗
Penalty amount not stated in 507-H; $10,000 per violation from RSA 358-A not verified in this pass.
Private action
0
No private right of action under this chapter or any other law.RSA 507-H:11 · source ↗
Rulemaking
0
No rulemaking authority; Secretary of State only posts a link to the chapter.RSA 507-H:2, II · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws