{ "jurisdiction_id": "US-NH", "jurisdiction": "United States – New Hampshire", "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 52, "sub_modules": 57, "source_register": 11 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Core instrument is in force, regulator identified, scope and thresholds well documented from primary DOJ sources.", "claims": [ { "statement": "The Data Privacy Unit within the Consumer Protection and Antitrust Bureau of the New Hampshire Attorney General's Office is tasked with enforcing the NHDPA and related data privacy laws.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The New Hampshire Attorney General has exclusive authority to enforce NHDPA violations under RSA 507-H:11, I, with no private right of action under this statute.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The New Hampshire Data Privacy Act, RSA 507-H, creates consumer rights with respect to personal data and imposes responsibilities on businesses, effective January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A violation of the NHDPA is treated as an unlawful act under RSA 358-A:2, the New Hampshire Consumer Protection Act, layering general consumer-protection remedies onto NHDPA enforcement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Personal data under the NHDPA is any information linked or reasonably linkable to an identified or identifiable individual, and does not include de-identified data or publicly available information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The NHDPA exempts numerous categories of federally-regulated data, including data subject to GLBA/Farm Credit Act, HIPAA, FERPA, the Driver's Privacy Protection Act, the Airline Deregulation Act, and Controlled Substances Act chemical-listing compliance data, as well as employment/B2B context data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The NHDPA applies to persons conducting business in New Hampshire or targeting NH residents that, in a one-year period, controlled/processed personal data of 35,000+ unique consumers, or 10,000+ unique consumers while deriving over 25% of gross revenue from the sale of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Hampshire's comprehensive privacy law received a minor 2024 amendment removing a mandate that the Secretary of State conduct rulemaking on privacy policies and consumer-rights exercise, making these provisions self-executing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/retrospective-2024-in-comprehensive-state-data-privacy-law", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Consent/sensitive-data provisions are well evidenced; pseudonymisation/anonymisation safe-harbour detail is not confirmed from sources searched.", "claims": [ { "statement": "The NHDPA structures most processing around a notice-and-opt-out model rather than an enumerated lawful-bases regime, reserving affirmative consent for sensitive data and known-child processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Once a business receives a consumer's request to revoke consent, it must stop processing the consumer's data within 15 days.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Sensitive data under the NHDPA includes racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, and precise geolocation data, among other categories defined at RSA 507-H:1, XXVIII.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers may not process sensitive data concerning a consumer without obtaining consent, and additional restrictions apply to processing sensitive data concerning a known child.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Rights and timelines are well documented directly from AG FAQ/guidance sources.", "claims": [ { "statement": "New Hampshire consumers have the right to confirm whether or not a controller is processing the consumer's personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Requests to delete personal data under RSA 507-H are the most common type of consumer complaint received by the Data Privacy Unit.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/news-and-media/new-hampshire-joins-bipartisan-consortium-privacy-regulators-collaborate-data", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers may opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers may obtain a copy of their personal data being controlled or processed by a business in a portable and readable format.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/news-and-media/attorney-general-formella-announces-creation-new-data-privacy-unit", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "If a controller declines to act on a consumer request, it must inform the consumer without undue delay, and not later than 45 days after receipt of the request, of the justification and appeal instructions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A controller has 60 days after receiving a consumer's appeal to inform the consumer in writing of any action taken or not taken, with a written explanation of its decision.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "DPIA, security and breach-notification duties are well evidenced; DPO appointment and retention/disposal specifics are not confirmed.", "claims": [ { "statement": "If a controller processes data or causes data to be processed after July 1, 2024, it must conduct and document a data protection assessment for each processing activity presenting a heightened risk of harm to a consumer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Processing presenting a heightened risk of harm includes targeted advertising, certain types of profiling, and the processing of sensitive data under RSA 507-H:8, I.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Processors must provide a report of any controller-arranged or independent assessment of the processor's policies and technical/organizational measures to the controller upon request, under RSA 507-H:7, II(e).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A processor may arrange for a qualified and independent assessor to conduct an assessment of the processor's policies and technical and organizational measures supporting its obligations under RSA 507-H.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers must implement reasonable data safeguards under RSA 507-H:6, I(c).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The NHDPA imposes limits on a controller's collection of data and antidiscrimination requirements under RSA 507-H:6, I(a) and (e).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Under RSA 359-C:20, as soon as a business becomes aware that the security or confidentiality of personal information has been compromised, it must promptly determine the likelihood of misuse and, if misuse is likely or cannot be ruled out, notify affected individuals and its primary regulator or the NH Attorney General.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/citizens/consumer-protection-antitrust-bureau/security-breach-notifications", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Attorney General's Consumer Protection and Antitrust Bureau has administrative enforcement authority over RSA 359-C:20, and private individuals also have a private right of action for violations of that statute.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/citizens/consumer-protection-antitrust-bureau/security-breach-notifications", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The NHDPA places limits on a controller's collection of data under RSA 507-H:6, I(a), but a specific retention-period or disposal-duty provision was not identified in sources searched.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No comprehensive cross-border transfer regime exists under the NHDPA; this is a legitimate structural gap, not an omission.", "claims": [] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Several sectoral exemptions are directly confirmed; others (GLBA, insurance, credit-scoring specifics) rely on inference from peer-law patterns and are marked accordingly.", "claims": [ { "statement": "The NHDPA exempts personal data regulated by the Farm Credit Act (12 U.S.C. 2001 et seq.) under RSA 507-H:3, II(n).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The NHDPA exempts patient safety work product for purposes of the Patient Safety and Quality Improvement Act (42 U.S.C. 299b-21 et seq.) under RSA 507-H:3, II(g).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Data processed or maintained in the course of an individual applying to, being employed by, or acting as an agent/independent contractor of a controller, processor, or third party is excluded from NHDPA scope where collected/used within the context of that role.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Personal data regulated by the Family Educational Rights and Privacy Act (20 U.S.C.) is exempted from NHDPA coverage under RSA 507-H:3, II.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "green", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Cookie/tracker opt-out and UOOM support are confirmed in force; dark-patterns and clean-room specifics are unconfirmed gaps.", "claims": [ { "statement": "Controllers may not engage in targeted advertising or selling personal data for consumers aged 13 to under 16 without consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A consumer can designate a third party to opt out on their behalf and can use an opt-out preference signal to exercise sale/targeted-advertising opt-out rights.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Universal opt-out mechanism (UOOM) requirements are already in effect in New Hampshire, alongside California, Colorado, Connecticut, Montana, Nebraska and Texas, effective January 1.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/there-s-no-opting-out-of-universal-opt-outs", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have the right to opt out of the processing of personal data for purposes of targeted advertising under RSA 507-H:4, I.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A consumer can opt out of the sale of personal data to third parties, and the controller must provide a process for submitting such opt-out requests.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/sites/g/files/ehbemt721/files/inline-documents/sonh/data-privacy-faqs-revised_0.pdf", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Profiling opt-out and DPIA trigger are confirmed; biometric/genetic specificity, ADM transparency/explanation rights, and surveillance carve-outs are unconfirmed.", "claims": [ { "statement": "Consumers may opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer, under RSA 507-H:4, I.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Processing for purposes of certain types of profiling is treated as heightened-risk processing under RSA 507-H:8, I(c), triggering the controller's data protection assessment duty.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "green", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Children's consent thresholds and guardian/conservator representation rights are directly confirmed from AG guidance sources.", "claims": [ { "statement": "The NHDPA applies a 'known child' consent standard for children under 13 and a heightened consent requirement for targeted advertising/sale for consumers aged 13 to under 16.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "In the case of processing personal data of a known child, the parent or legal guardian may exercise NHDPA consumer rights on the child's behalf.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers may not process sensitive data concerning a known child without consent, and may not engage in targeted advertising or selling personal data for subjects aged 13 to under 16 without consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "In the case of processing personal data concerning a consumer subject to a guardianship, conservatorship, or other protective arrangement, the guardian or conservator may exercise consumer rights on that consumer's behalf.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "green", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-hampshire/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Penalty levels, cure-period mechanics, and recent enforcement activity are directly confirmed from AG and IAPP sources; the precise date of the cure-period sunset to AG discretion needs primary-statute confirmation.", "claims": [ { "statement": "The Attorney General has the ability to seek civil penalties of up to $10,000 for each violation of the NHDPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/news-and-media/attorney-general-formella-announces-creation-new-data-privacy-unit", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Attorney General can seek criminal penalties, up to $100,000 per violation, if there is sufficient evidence a business is purposely failing to comply with the NHDPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/news-and-media/attorney-general-formella-announces-creation-new-data-privacy-unit", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "If the AG determines a cure is possible, it will issue a notice of violation with a 60-day cure period before initiating an action, though issuing this notice is discretionary, not mandatory.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Data Privacy Unit has issued several Notices of Violation during the law's initial cure period, leading to corrective actions without litigation, and has opened multiple privacy investigations, several of which remain ongoing.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/news-and-media/new-hampshire-joins-bipartisan-consortium-privacy-regulators-collaborate-data", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Data Privacy Unit, now fully staffed, includes an Assistant Attorney General and an Investigative Paralegal.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/news-and-media/attorney-general-formella-announces-publication-frequently-asked-questions-new", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "As part of the state budget process, the Senate added resources to the Department of Justice's Consumer Protection and Antitrust Bureau, allotting an additional $1 million in settlement funds to pay for an attorney, paralegal, and investigator dedicated to privacy enforcement.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/state-lawmakers-take-on-new-hampshire-comprehensive-privacy-bills-impacts", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The NHDPA does not provide for a private right of action, per RSA 507-H:11, IV.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/data-privacy-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Unlike the NHDPA, the separate RSA 359-C:20 security-breach-notification statute provides private individuals with a private right of action, in addition to AG administrative enforcement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/citizens/consumer-protection-antitrust-bureau/security-breach-notifications", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Hampshire joined a bipartisan consortium of privacy regulators to collaborate on data privacy enforcement, coordinating with other state AG offices with similar privacy laws while retaining independent authority over its own cases and consumer data.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "NH Department of Justice", "source_url": "https://www.doj.nh.gov/news-and-media/new-hampshire-joins-bipartisan-consortium-privacy-regulators-collaborate-data", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The NHDPA's 60-day cure period was designed, as a legislative compromise, to sunset to attorney-general discretion in 2026.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/state-lawmakers-take-on-new-hampshire-comprehensive-privacy-bills-impacts", "source_tier": null, "observed_at": "2026-08-06" } ] } ] }