New Hampshire Data Privacy Act (RSA Chapter 507-H)
NHDPA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Lower numerical threshold.
Core threshold: 35,000 consumers; or 10,000 consumers and >25% gross revenue from sale
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Access | ✓ Included / qualified by statute |
| Correction | ✓ Included / qualified by statute |
| Deletion | ✓ Included / qualified by statute |
| Portability | ✓ Included / qualified by statute |
| Opt-out targeted advertising | ✓ Included / qualified by statute |
| Opt-out sale | ✓ Included / qualified by statute |
| Opt-out qualifying profiling | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Consent required
Known-child sensitive data follows COPPA.
Business obligations
Data minimization, purpose limitation, reasonable security, sensitive-data consent, processor duties and data protection assessments.
Enforcement
Authority: New Hampshire Attorney General
Private right of action: No
Penalty / remedy baseline: Violation treated as unfair/deceptive practice under RSA 358-A
What makes New Hampshire different?
New Hampshire combines relatively low thresholds with an explicit, strong consent definition and a post-2025 discretionary cure regime rather than a permanent mandatory cure right.
Developments to watch
Since January 1, 2026, the Attorney General may decide whether to offer a cure opportunity based on statutory factors.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.