New Hampshire Expectation of Privacy Act (RSA chapter 507-H)
New Hampshire privacy law (NHPA): controller duties
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and publish an accessible privacy notice that shows when it was last updated. They must offer a clear opt-out link and honour universal opt-out preference signals, which applied from 1 Jan 2025. Data protection assessments are required for processing that presents a heightened risk of harm.
Key points
Data minimisation: collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes.
Section: RSA 507-H:6, I(a)
Consent must be revocable as easily as given, with processing stopped within 15 days.
Section: RSA 507-H:6, I(f)
Privacy notice must list categories of data, purposes, how to exercise and appeal rights, categories of data shared and of third parties, an active email or online contact, and the date last updated, and be accessible to people with disabilities.
Section: RSA 507-H:6, III
Sales and targeted advertising must be disclosed clearly with the way to opt out.
Section: RSA 507-H:6, IV
A clear website opt-out link is required, and universal opt-out preference signals must be honoured from 1 Jan 2025.
Section: RSA 507-H:6, V(a)(1)(A)-(B)
Assessments are required for targeted advertising, sale, risky profiling and sensitive data, for activities created after 1 Jul 2024.
Section: RSA 507-H:8, I, VI
Sources
Compare controller duties across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 35: Data protection impact assessment (assessments)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the New Hampshire statute
Reference material, not legal advice.