{ "type": "practice-guide", "canonical": "https://openagreements.org/practice-guides/privacy/us/new-hampshire", "links": [ { "rel": "self", "href": "https://openagreements.org/practice-guides/privacy/us/new-hampshire.json", "type": "application/json" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/new-hampshire", "type": "text/html" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/new-hampshire/markdown", "type": "text/markdown" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/new-hampshire/json", "type": "application/json" } ], "data": { "topic": "privacy", "state": "new-hampshire", "frontmatter": { "title": "New Hampshire Consumer Privacy Law (NHPA)", "description": "The New Hampshire Privacy Act gives New Hampshire consumers rights over their personal data and imposes notice, contracting, and consent duties on controllers above defined thresholds — a member of the Virginia/Connecticut family of state privacy laws, it is enforced exclusively by the Attorney General with no private right of action and a cure period that became discretionary after 2025.", "state": "New Hampshire", "lastReviewed": "2026-06-06", "license": "CC BY 4.0", "authors": [ "steven-obiajulu" ], "summary": { "keyLaw": "N.H. Rev. Stat. Ann. ch. 507-H (New Hampshire Privacy Act), effective January 1, 2025", "appliesTo": "Persons doing business in New Hampshire (or targeting residents) that in a one-year period control or process the data of 35,000+ unique consumers (excluding payment-only data), or 10,000+ consumers while deriving more than 25% of gross revenue from selling data — no revenue floor; nonprofits, higher education, and GLBA- and HIPAA-regulated entities exempt", "privacyPolicyRequired": "Yes — a clear and meaningful privacy notice in a reasonably accessible format with statutorily fixed contents", "privateRightOfAction": "No — enforcement is exclusively the Attorney General's", "regulator": "New Hampshire Attorney General (exclusive)", "bottomLine": "If you meet the 35,000-consumer (or 10,000 plus majority-share-of-revenue-from-data-sale) threshold in New Hampshire, ch. 507-H requires a privacy notice, opt-in consent to process sensitive data, and processor contracts — enforced by the Attorney General with no consumer lawsuits and a cure period that became discretionary on January 1, 2026.", "lawCoverage": "comprehensive", "policyMandate": "statutoryContents", "consumersCanSue": "no", "sensitiveDataConsent": "optIn", "universalOptOutSignal": "required" }, "about": [ "New Hampshire Privacy Act NHPA", "New Hampshire privacy policy requirements", "New Hampshire privacy notice contents", "New Hampshire privacy law applicability thresholds", "New Hampshire sensitive data consent", "New Hampshire processor contract requirements", "New Hampshire Attorney General privacy enforcement", "New Hampshire privacy law no private right of action" ], "translations": [ { "language": "中文", "status": "planned" }, { "language": "Español", "status": "planned" }, { "language": "Português", "status": "planned" }, { "language": "Deutsch", "status": "planned" } ] }, "questions": [ { "slug": "does-nhpa-apply", "label": "Does the New Hampshire Privacy Act apply to your business?", "heading": "Does the New Hampshire Privacy Act apply to your business?", "answerText": "It turns on consumer volume, not revenue. The Act applies to persons that conduct business in New Hampshire or target its residents and that, in a one-year period, control or process the personal data of at least 35,000 unique consumers (excluding data handled solely to complete a payment transaction), or at least 10,000 consumers while deriving more than 25% of gross revenue from selling personal data.", "sources": [ { "id": "stat-507h2-apply", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:2", "citation": "N.H. Rev. Stat. Ann. § 507-H:2, I.", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-2.htm", "proposition": "The New Hampshire Privacy Act applies to persons doing business in the state or targeting its residents that, in a one-year period, control or process the data of at least 35,000 unique consumers (excluding payment-only data), or at least 10,000 consumers while deriving more than 25% of gross revenue from selling personal data.", "verbatimQuote": "This chapter applies to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state that during a one year period: (a) Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) Controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25 percent of their gross revenue from the sale of personal data.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h2-apply" } ] }, { "slug": "privacy-policy-contents", "label": "What must your New Hampshire privacy policy contain?", "heading": "What must your New Hampshire privacy policy contain?", "answerText": "A controller must provide a clear and meaningful privacy notice in a reasonably accessible format. The notice must list the categories of personal data processed, the purpose for processing, how consumers exercise and appeal their rights, the categories of personal data shared with third parties and the categories of those third parties, a contact mechanism, and the date the notice was last updated.", "sources": [ { "id": "stat-507h6-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:6", "citation": "N.H. Rev. Stat. Ann. § 507-H:6, III.", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-6.htm", "proposition": "A controller must provide consumers with a clear and meaningful privacy notice in a reasonably accessible format.", "verbatimQuote": "A controller shall provide consumers with a clear and meaningful privacy notice in a reasonably accessible format.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h6-notice" }, { "id": "stat-507h6-notice-contents", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:6", "citation": "N.H. Rev. Stat. Ann. § 507-H:6, III.", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-6.htm", "proposition": "The privacy notice must list the categories of personal data processed, the purpose for processing, how consumers exercise and appeal their rights, the categories of personal data shared with third parties and of those third parties, a contact mechanism, and the date the notice was last updated.", "verbatimQuote": "The notice must include the following: (a) The categories of personal data processed by the controller; (b) The purpose for processing personal data; (c) How consumers may exercise their consumer rights, including how a consumer may appeal a controller's decision with regard to the consumer's request; (d) The categories of personal data that the controller shares with third parties, if any; (e) The categories of third-parties, if any, with which the controller shares personal data; (f) An active electronic mail address or other online mechanism that the consumer may use to contact the controller; and (g) The date the privacy notice was last updated.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h6-notice-contents" } ] }, { "slug": "vendor-contracts", "label": "What must your contracts with processors say?", "heading": "What must your contracts with processors say?", "answerText": "A contract between a controller and a processor must govern the processor's data processing on the controller's behalf — so a data processing agreement is a statutory requirement, not a best practice.", "sources": [ { "id": "stat-507h7-contract", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:7", "citation": "N.H. Rev. Stat. Ann. § 507-H:7, II.", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-7.htm", "proposition": "A contract between a controller and a processor must govern the processor's data processing procedures with respect to processing performed on behalf of the controller.", "verbatimQuote": "A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h7-contract" }, { "id": "stat-507h7-setforth", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:7", "citation": "N.H. Rev. Stat. Ann. § 507-H:7, II.", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-7.htm", "proposition": "The contract must be binding and clearly set forth instructions for processing, the nature and purpose of processing, the type of data, the duration of processing, and the rights and obligations of both parties.", "verbatimQuote": "The contract shall be binding and clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing and the rights and obligations of both parties.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h7-setforth" }, { "id": "stat-507h7-terms", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:7", "citation": "N.H. Rev. Stat. Ann. § 507-H:7, II(a)-(e).", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-7.htm", "proposition": "The contract must also require the processor to maintain confidentiality, delete or return data at the controller's direction, make available information to demonstrate compliance, bind any subcontractor by written contract after an opportunity to object, and allow and cooperate with reasonable assessments.", "verbatimQuote": "The contract shall also require that the processor: (a) Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data; (b) At the controller's direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law; (c) Upon the reasonable request of the controller, make available to the controller all information in its possession necessary to demonstrate the processor's compliance with the obligations in this chapter; (d) After providing the controller an opportunity to object, engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the obligations of the processor with respect to the personal data; and (e) Allow, and cooperate with, reasonable assessments by the controller or the controller's designated assessor, or the processor may arrange for a qualified and independent assessor to conduct an assessment of the processor's policies and technical and organizational measures in support of the obligations under this chapter, using an appropriate and accepted control standard or framework and assessment procedure for such assessments.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h7-terms" } ] }, { "slug": "sensitive-data", "label": "Do you need consent to process sensitive data?", "heading": "Do you need consent to process sensitive data?", "answerText": "Yes. A controller may not process a consumer's sensitive data without first obtaining consent, and for a known child it must instead process the data in accordance with the federal Children's Online Privacy Protection Act. Sensitive data includes data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; personal data collected from a known child; and precise geolocation data.", "sources": [ { "id": "stat-507h6-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:6", "citation": "N.H. Rev. Stat. Ann. § 507-H:6, I(d).", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-6.htm", "proposition": "A controller may not process a consumer's sensitive data without consent, and must process a known child's sensitive data in accordance with COPPA.", "verbatimQuote": "Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with COPPA;", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h6-consent" } ] }, { "slug": "consumer-lawsuit", "label": "Can a consumer sue your business under the New Hampshire Privacy Act?", "heading": "Can a consumer sue your business under the New Hampshire Privacy Act?", "answerText": "No. The Attorney General has exclusive authority to enforce ch. 507-H, and the statute expressly provides no private right of action for consumers.", "sources": [ { "id": "stat-507h11-enforce", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:11", "citation": "N.H. Rev. Stat. Ann. § 507-H:11, I.", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-11.htm", "proposition": "The Attorney General has exclusive authority to enforce violations of ch. 507-H.", "verbatimQuote": "The attorney general shall have exclusive authority to enforce violations under this chapter.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h11-enforce" }, { "id": "stat-507h11-no-pra", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:11", "citation": "N.H. Rev. Stat. Ann. § 507-H:11, IV.", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-11.htm", "proposition": "Chapter 507-H does not create a private right of action for its violations or any other law.", "verbatimQuote": "Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations under this chapter or any other law.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h11-no-pra" }, { "id": "stat-507h11-cure", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "N.H. Rev. Stat. Ann. § 507-H:11", "citation": "N.H. Rev. Stat. Ann. § 507-H:11, II.", "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-11.htm", "proposition": "Through December 31, 2025, the Attorney General had to issue a notice of violation and allow 60 days to cure where a cure was possible; afterward the opportunity to cure became discretionary.", "verbatimQuote": "During the period beginning January 1, 2025 and ending December 31, 2025, the attorney general shall, and following said period the attorney general may, prior to initiating any action for a violation under this chapter, issue a notice of violation to the controller if the attorney general determines that a cure is possible. If the controller fails to cure such violation within 60 days of receipt of the notice of violation, the attorney general may bring an action pursuant to this section.", "anchor": "https://openagreements.org/practice-guides/privacy/us/new-hampshire#src-stat-507h11-cure" } ] } ] } }