---
title: "New Hampshire privacy law (NHPA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/new-hampshire/applicability"
source: "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

New Hampshire Expectation of Privacy Act (RSA chapter 507-H)

# New Hampshire privacy law (NHPA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Act applies to persons doing business in New Hampshire or targeting its residents that, in a one-year period, handled personal data of at least 35,000 unique consumers (payment-only data excluded), or at least 10,000 unique consumers while earning more than 25% of gross revenue from selling personal data. Nonprofits, higher education institutions, HIPAA covered entities and business associates, and GLBA financial institutions are exempt as entities, and a long list of regulated data is exempt.

## Key points

1. Thresholds: 35,000 unique consumers, or 10,000 unique consumers plus more than 25% of gross revenue from sales, in a one-year period.

   Section: [RSA 507-H:2, I(a)-(b)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

2. Entity exemptions: government bodies, nonprofits, higher education institutions and national securities associations.

   Section: [RSA 507-H:3, I(a)-(d)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

3. GLBA: a financial institution or data subject to GLBA Title V is exempt (entity and data).

   Section: [RSA 507-H:3, I(e)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

4. HIPAA covered entities and business associates are exempt as entities; protected health information is also exempt as data.

   Section: [RSA 507-H:3, I(f), II(a)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

5. Employee, applicant and contractor data used in that role is exempt, and consumer excludes people acting in a commercial or employment context.

   Section: [RSA 507-H:3, II(o); RSA 507-H:1, VIII](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

## Sources

- [RSA chapter 507-H (merged text with source notes)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the New Hampshire statute](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

Reference material, not legal advice.

## Other topics for New Hampshire

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-hampshire/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-hampshire/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/new-hampshire/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/new-hampshire/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/new-hampshire/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-hampshire/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents