New Hampshire Expectation of Privacy Act (RSA chapter 507-H)
New Hampshire privacy law (NHPA): applicability
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The Act applies to persons doing business in New Hampshire or targeting its residents that, in a one-year period, handled personal data of at least 35,000 unique consumers (payment-only data excluded), or at least 10,000 unique consumers while earning more than 25% of gross revenue from selling personal data. Nonprofits, higher education institutions, HIPAA covered entities and business associates, and GLBA financial institutions are exempt as entities, and a long list of regulated data is exempt.
Key points
Thresholds: 35,000 unique consumers, or 10,000 unique consumers plus more than 25% of gross revenue from sales, in a one-year period.
Section: RSA 507-H:2, I(a)-(b)
Entity exemptions: government bodies, nonprofits, higher education institutions and national securities associations.
Section: RSA 507-H:3, I(a)-(d)
GLBA: a financial institution or data subject to GLBA Title V is exempt (entity and data).
Section: RSA 507-H:3, I(e)
HIPAA covered entities and business associates are exempt as entities; protected health information is also exempt as data.
Section: RSA 507-H:3, I(f), II(a)
Employee, applicant and contractor data used in that role is exempt, and consumer excludes people acting in a commercial or employment context.
Sources
Compare applicability across all states
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the New Hampshire statute
Reference material, not legal advice.