Q: What does New Hampshire’s recently enacted privacy law mean for individuals and businesses?
A: New Hampshire has joined a group of 20 states that have enacted an information privacy law. With this law taking effect on January 1, 2025, businesses need to act now to come into compliance with it.
Application
The privacy law applies to entities that are conducting business in New Hampshire or targeting residents of this state, and either a) have the personal data of at least 35,000 residents or b) generate over 25 percent of their gross revenue from the sale of personal data and have personal data of at least 10,000 residents.
Under the law, “personal data” is defined as “any information that is linked or reasonably linkable to an identified or identifiable individual.” New Hampshire’s definition of personal data does not include publicly available information or data that has been de-identified.
Individual Rights
The privacy law provides rights to individuals, including the right to confirm whether a business is using their personal data; access, obtain, and delete their personal data; correct inaccuracies in their personal data; and opt-out of having their data used for targeted advertising or sold. Parents can also exercise these rights on behalf of their children.
Business Obligations
The privacy law differentiates between “controllers,” which are businesses that make decisions about personal data, and “processors,” which are businesses that process personal data on behalf of a controller. Controllers are required to limit the collection of personal data; implement and maintain reasonable data security practices to protect personal data; establish and provide individuals with a privacy notice; and cease the processing of personal data no later than 15 days after receiving an individual’s revocation of consent.
Controllers must obtain consent before processing sensitive data, which includes data related to race, ethnicity, religious beliefs, health conditions or diagnosis, sexual orientation, citizenship, immigration status, genetic or biometric data, children’s data, and geolocation data. Consent is also required before selling personal data or processing personal data for targeted advertising.
Processors must assist controllers in meeting their obligations under the law by adhering to their contractual obligations.
Enforcement
The New Hampshire Attorney General has exclusive authority to enforce the privacy law. In 2025, the Attorney General may notify businesses of curable violations and allow 60 days for the business to cure the violation. In 2026, the Attorney General has the discretion to determine if a business should be given the opportunity to cure the violation before initiating action for a violation. Consumers cannot bring lawsuits directly against businesses for violating their rights under the privacy law.
Know the Law is a bi-weekly column sponsored by McLane Middleton. Questions and ideas for future columns should be emailed to knowthelaw@mclane.com. Know the Law provides general legal information, not legal advice. We recommend that you consult a lawyer for guidance specific to your particular situation.