New Hampshire Expectation of Privacy Act (RSA chapter 507-H)
New Hampshire privacy law (NHPA): enforcement
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The Attorney General enforces the Act exclusively, and there is no private right of action. The mandatory 60-day cure period applied only in 2025; from 1 Jan 2026 a cure is discretionary. A violation is an unfair or deceptive practice under the Consumer Protection Act, which allows civil penalties of up to $10,000 per violation.
Key points
Exclusive enforcement by the Attorney General.
Section: RSA 507-H:11, I
2025: notice and 60 days to cure where a cure was possible; afterwards the Attorney General may give notice.
Section: RSA 507-H:11, II
From 1 Jan 2026 the decision to allow a cure weighs factors such as number of violations, size, nature of processing, risk of injury and error.
Section: RSA 507-H:11, III
A violation is an unfair or deceptive act under RSA 358-A:2.
Section: RSA 507-H:11, V
Courts may award the state civil penalties of up to $10,000 for each violation.
Section: RSA 358-A:4, III(b)
No private right of action.
Section: RSA 507-H:11, IV
Sources
Compare enforcement across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the New Hampshire statute
Reference material, not legal advice.