New Hampshire Expectation of Privacy Act (RSA chapter 507-H)
New Hampshire privacy law (NHPA): processors
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Processors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. A binding contract must set out the processing instructions and require confidentiality, deletion or return, proof of compliance, subcontractor flow-down after a chance to object, and cooperation with assessments.
Key points
Processors must follow instructions and assist the controller.
Section: RSA 507-H:7, I
Contract must set out instructions, nature and purpose, data types, duration, and the rights and obligations of both parties.
Section: RSA 507-H:7, II
Required terms: confidentiality, deletion or return, information to show compliance, subcontractors after a chance to object, and assessments.
Section: RSA 507-H:7, II(a)-(e)
A processor that decides purposes and means becomes a controller for that processing.
Section: RSA 507-H:7, IV
Sources
Compare processors across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 28: Processor (processors)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the New Hampshire statute
Reference material, not legal advice.