New Hampshire Privacy Law

The New Hampshire Privacy Act (NHPA) was signed into law on March 6, 2024, and became effective on January 1, 2025. New Hampshire adopted a framework with relatively low applicability thresholds, reflecting the state's smaller population, and providing comprehensive consumer privacy rights. The NHPA provides New Hampshire consumers with broad privacy rights, including the right to access, correct, delete, and port personal data, as well as opt-out rights for data sales, targeted advertising, and profiling. The law includes an appeals process for denied consumer requests and requires data protection assessments for high-risk processing activities. The law applies to entities conducting business in New Hampshire or targeting New Hampshire consumers that control or process personal data of 35,000 or more consumers (excluding payment transaction data), or control or process personal data of 10,000 or more consumers while deriving more than 25% of gross revenue from the sale of personal data. The NHPA includes a 60-day cure period and penalties of up to $10,000 per violation, enforced by the New Hampshire Attorney General.