Last updated: January 2025

Please note this is a highlighted overview and not a complete overview of privacy laws for this state. If you would like a complete review of this state's privacy laws or a multi-state privacy compliance cheat sheet on specific topics, please contact Vivien Peaden at vpeaden@bakerdonelson.com.

Disclaimer: These materials do not constitute legal advice and should not be substituted for the advice of legal counsel.

The New Hampshire Data Privacy Act (NHDPA)

Effective Date: January 1, 2025

1. Applicability Thresholds:

Subject to certain entity-level and data-level exemptions, the NHDPA applies to an individual or legal entity conducting business in New Hampshire or producing products or services targeted to New Hampshire residents (consumers), and, during a one-year period, controlling or processing either:

• 35,000+ NH consumers' personal data (excluding personal data solely for the completion of payment transactions); or
• 10,000+ NH consumers' personal data and derive more than 25 percent of its revenue from the sale of personal data.

2. Key Definitions:

Sales of Personal Data: Similar to California, "sale of personal data" is broadly defined to include the exchange of personal data for not only monetary compensation but also "other valuable consideration," subject to certain exemptions.

3. Business Obligations:

The NHDPA imposes additional obligations on persons who, alone or jointly with others, determine the purpose and means of processing personal information (Controller):

• Heightened Protection for Minor Under the Age of 16: Teenagers who are at least 13 but younger than 16 years of age and children under the age of 13 are afforded heightened protection under the NHDPA.
• Data Processing Agreement (DPA): Processing activities by a third party on the Controller's behalf (Processor) shall be governed by a DPA between the Controller and Processor.
• Data Protection Assessment. Yes, where processing activities present a heightened risk of harm to consumers, including targeted advertising, sales of personal data, high-risk profiling activities, and processing of sensitive data.
  • Note that the requirements for data protection assessment apply to "processing activities created or generated after July 1, 2024, and are not retroactive."
• Privacy Notice: Yes, a Controller must provide consumers with a privacy notice that is reasonably accessible, clear, meaningful, and discloses categories of information processed, and the purpose of processing, among others.
• Data Minimization and Purpose Limitation of Data Processing: A Controller shall: (i) limit the collection of personal data to what is "adequate, relevant, and reasonably necessary"; and (ii) process personal data for purposes that are compatible with the original purpose of data collection.
• Universal Opt-out Mechanism: Effective January 1, 2025, a Controller must allow a consumer to opt out of any personal data processing for targeted advertising, or any personal data sales, by sending the Controller an "opt-out preference signal...by a platform, technology, or mechanism…indicating such consumer's intent to opt-out of any such processing or sale."

4. Consumer Rights:

Subject to certain exceptions, a New Hampshire consumer has the right to:

• Confirm whether a Controller is processing their personal data, and access the categories of data being processed;
• Correct inaccuracies in the consumer's personal data;
• Delete personal data provided by, or obtained about, the consumer;
• Obtain a copy of their personal data processed by the Controller; and
• Opt-out of data processing for targeted advertising, sales of personal data, and profiling for solely automated decisions producing legal or similarly significant effects.

5. Enforcement and Penalties:

Private Right of Action: None.

Penalties:

• Up to $10,000 per violation in civil penalties.
• Up to $100,000 per violation for criminal penalties of up to $100,000 if there is sufficient evidence that a business is purposely failing to comply with the requirements of NHDPA.

Cure Period: 60-day cure period following receipt of the notice of violation by the New Hampshire attorney general. This grace period is only available until December 31, 2025.