The New Hampshire Attorney General’s Office has published guidance on the state’s new consumer data privacy law, which took effect on January 1, 2025. The law (2024 SB 255) was signed by former Governor Sununu last year.

You can view the full guidance here: New Hampshire Consumer Data Privacy FAQs – NH Attorney General’s Office.

See NH RSA 507-H for the new law in its entirety.

What Does the Law Do?

The New Hampshire Data Privacy Act (NHDPA) guarantees consumers access to and some control over how businesses handle their personal data.

As of January 1, 2025, consumers have the right to:

• Confirm whether or not a business is controlling or processing their personal data;
• Correct any inaccuracies in their personal data being processed by businesses;
• Demand the deletion of personal data obtained from or about them;
• Obtain a copy of their personal data being controlled or processed by the business in a portable, and readable format;
• Opt-out of the future processing of their personal data for purposes of targeted advertising, the sale of personal data, or profiling

The NHDPA provides businesses with 45 days to comply with a consumer’s request to exercise their rights under the law. Businesses may extend the deadline by another 45 days when “reasonably necessary.”

Importantly, the law also requires businesses to limit collection of consumer data to only the information necessary to carry out the purpose for collecting the data in the first place. The consumer’s consent is required to collect data beyond what is necessary, or to collect sensitive data including race, ethnicity, religion, health status, citizenship, location data, or genetic data.

Businesses are required to protect the confidentiality of data collected and must provide the opportunity for consumers to opt out of having their data processed by a third party. The law allows for businesses to deny requests under certain conditions but also establishes an appeals process for consumers. Ultimately, consumers may seek assistance or redress from the New Hampshire Attorney General.

The NHDPA empowers the Attorney General to enforce the law, with penalties up to $10,000 per violation. The law does not permit private rights of action – individual lawsuits – as a remedy for consumers who believe they were harmed.

Which Businesses and Entities Have to Comply?

The NHDPA applies to any person or business that control or processes the personal data of:

– 35,000 or more unique consumers (not including data controlled or processed for the purpose of completing a payment transaction); or

– 10,000 or more unique customers and derives 25% or more of their gross revenue from the sale of personal data.

A controller is a person or entity that determines the purpose and means of how personal data is processed. Processing means manual or automated actions that result in the collection, use, storage, disclosure, analysis, deletion or modification of personal data. Processors and controllers can be the same or different persons or entities.

See NH RSA 507-H:1 for more information about these definitions.

There is also a list of exemptions for certain types of data, including data:

– regulated under HIPAA;

– used for clinical research;

– regulated by the Family Educational Rights and Privacy Act;

– collected, processed, sold or disclosed in compliance with the Farm Credit Act; and

– maintained or used for purposes of compliance with the regulation of listed chemicals under the federal Controlled Substances Act.

See NH RSA 507-H:3 for more information about data or entities excluded from regulation under the NHDPA.