--- title: "New Hampshire privacy law (NHPA): overview" canonical: "https://dposchool.com/state-privacy-laws/state/new-hampshire" source: "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Comprehensive state privacy law # New Hampshire privacy law New Hampshire Expectation of Privacy Act (RSA chapter 507-H) Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) - **Citation:** N.H. Rev. Stat. Ann. §§ 507-H:1 to 507-H:12 - **Official text:** https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm - **Enacted:** [2024 N.H. Laws ch. 5 (with technical amendments in 2024 N.H. Laws ch. 229)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm) - **In force:** January 1, 2025 - **Effective dates:** - **January 1, 2025:** main provisions, including universal opt-out signals (RSA 507-H:6, V(a)(1)(B)) - **January 1, 2026:** mandatory 60-day cure period ended 31 Dec 2025; cure became discretionary (RSA 507-H:11, II-III) - **January 1, 2027:** ban on selling a child's personal data (RSA 507-H:6, I(e-1), added by 2026 N.H. Laws ch. 168) - **Enforcer:** Attorney General (exclusive) - **Private right of action:** No. No private right of action under the chapter or any other law (RSA 507-H:11, IV). - **Cure period:** 60 days. Ended December 31, 2025. During 2025 the Attorney General had to give notice and 60 days to cure where a cure was possible. From 1 Jan 2026 the Attorney General may give a cure opportunity, weighing listed factors. (RSA 507-H:11, II-III) - **Rulemaking:** No. No rulemaking power; the Secretary of State must only post a link to the chapter (RSA 507-H:2, II). ## Amendments - [2024 N.H. Laws ch. 229, §§ 2 to 6](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm) (in force January 1, 2025). Amendments to RSA 507-H:1, :2, :4 and :6 that took effect at 12:01 a.m. on 1 Jan 2025, alongside the original Act (content of each change not separately verified). - [2026 N.H. Laws ch. 168 (HB 1460-FN), signed 2026-06-19](https://gc.nh.gov/bill_status/billinfo.aspx?id=2443) (in force January 1, 2027). Adds RSA 507-H:6, I(e-1): a controller may not sell a child's personal data (child as defined by COPPA, under 13). ## Topics - [Applicability](https://dposchool.com/state-privacy-laws/state/new-hampshire/applicability): The Act applies to persons doing business in New Hampshire or targeting its residents that, in a one-year period, handled personal data of at least 35,000 unique consumers (payment-only data excluded), or at least 10,000 unique consumers while earning more than 25% of gross revenue from selling personal data. Nonprofits, higher education institutions, HIPAA covered entities and business associates, and GLBA financial institutions are exempt as entities, and a long list of regulated data is exempt. - [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-hampshire/consumer-rights): Consumers may confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and solely automated profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. Opt-out requests need not be authenticated. - [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-hampshire/sensitive-data): Sensitive data may be processed only with the consumer's opt-in consent, and data of a known child must be processed under COPPA. A controller that knows and wilfully disregards that a consumer is 13 to 15 may not sell the data or use it for targeted advertising without consent. From 1 Jan 2027 a controller may not sell a child's personal data at all. - [Controller duties](https://dposchool.com/state-privacy-laws/state/new-hampshire/controller-duties): Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and publish an accessible privacy notice that shows when it was last updated. They must offer a clear opt-out link and honour universal opt-out preference signals, which applied from 1 Jan 2025. Data protection assessments are required for processing that presents a heightened risk of harm. - [Processors](https://dposchool.com/state-privacy-laws/state/new-hampshire/processors): Processors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. A binding contract must set out the processing instructions and require confidentiality, deletion or return, proof of compliance, subcontractor flow-down after a chance to object, and cooperation with assessments. - [Enforcement](https://dposchool.com/state-privacy-laws/state/new-hampshire/enforcement): The Attorney General enforces the Act exclusively, and there is no private right of action. The mandatory 60-day cure period applied only in 2025; from 1 Jan 2026 a cure is discretionary. A violation is an unfair or deceptive practice under the Consumer Protection Act, which allows civil penalties of up to $10,000 per violation. ## Sources - [RSA chapter 507-H (merged text with source notes)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm) - [HB 1460-FN (2026) bill status: signed 06/19/2026, chapter 168, effective 01/01/2027](https://gc.nh.gov/bill_status/billinfo.aspx?id=2443) - [HB 1460-FN chaptered final version (chapter 168)](https://gc.nh.gov/bill_Status/pdf.aspx?id=33954&q=billVersion) - [RSA 358-A:4, III(b) (civil penalties under the Consumer Protection Act)](https://gc.nh.gov/rsa/html/XXXI/358-A/358-A-4.htm) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the New Hampshire statute](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm) Reference material, not legal advice. ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / New Hampshire Previous: [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska) Next: [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents