New Hampshire Data Privacy Act (NHDPA) Reference Guide

The NHDPA applies to persons doing business in New Hampshire or producing products or services targeted to residents that, during a one-year period, control or process at least 35,000 unique consumers’ personal data, excluding data handled solely to complete a payment transaction. The alternative is at least 10,000 unique consumers plus more than 25% of gross revenue from personal-data sales. RSA 507-H:2: application

The chapter excludes specified state bodies, nonprofits, higher education, registered securities associations, GLBA financial institutions and data, and HIPAA covered entities and business associates. It separately exempts enumerated regulated data and employment-context information. RSA 507-H:3: exclusions

Analytics sessions, devices and cookie identifiers do not automatically equal the statute’s unique-consumer count. Legal and data teams should define a documented counting method tied to the data actually controlled or processed.

New Hampshire consumers may confirm processing and access personal data, correct inaccuracies, delete personal data, obtain eligible data in portable form, and opt out of targeted advertising, personal-data sales and qualifying solely automated profiling. RSA 507-H:4: consumer rights

Controllers generally must respond within 45 days, with one reasonably necessary 45-day extension. A refusal must explain the decision and appeal method; appeals must be decided within 60 days. RSA 507-H:4: request timing and appeals

New Hampshire defines sale as an exchange of personal data for monetary or other valuable consideration, subject to listed exclusions. Targeted advertising concerns ads selected using activity over time and across nonaffiliated sites or apps. RSA 507-H:1: definitions

A controller that sells personal data or processes it for targeted advertising must clearly disclose the processing and the opt-out method. The website must include a clear and conspicuous link to a page that enables the consumer or agent to opt out. RSA 507-H:6, IV–V

Covered controllers must allow consumers to opt out of targeted advertising and personal-data sales through a qualifying preference signal sent with the consumer’s consent. The mechanism must require an affirmative choice, be consumer-friendly, align with similar legal mechanisms and support residency and legitimacy determinations. RSA 507-H:6, V(a)(1)(B)

Consumers may also designate an authorized agent through technology such as a link, browser setting, browser extension or global device setting. Controllers must comply when they can verify the consumer and the agent’s authority with commercially reasonable effort. RSA 507-H:5: consumer agents

The New Hampshire Attorney General has exclusive authority to enforce the NHDPA, and the chapter disclaims a private right of action. A violation is treated as an unfair or deceptive trade practice under RSA 358-A:2. RSA 507-H:11: enforcement

During 2025, the Attorney General had to offer a 60-day cure opportunity before initiating an action when a cure was possible. Beginning January 1, 2026, the Attorney General may offer that opportunity after considering factors including the number of violations, organization size and complexity, processing scope, likely public injury, safety, and whether human or technical error likely caused the violation. RSA 507-H:11, II–III

RSA 358-A:4 authorizes civil penalties up to $10,000 per violation, as well as court orders and restitution. RSA 358-A:4: administration and enforcement

Counsel determines coverage, exemptions, sale, targeted advertising, profiling, sensitive-data treatment and child-data obligations. Product and engineering teams implement those decisions across consent tools, hard-coded scripts, tag managers, APIs and downstream platforms.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This guide relies on the current New Hampshire Revised Statutes, the final enacted text of SB 255, the Department of Justice data-privacy page and the enacted 2026 child-data amendment. The codified chapter reflects current law and labels the January 1, 2027 provision as future-effective.

Prepared by Etalon Editorial Team. Last reviewed September 28, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exclusions, classifications, notices, requests, sensitive data, children, contracts, assessments and governance.