The New Hampshire Privacy Act

New Hampshire, known for its "Live Free or Die" motto, is taking a balanced approach to data privacy with the New Hampshire Privacy Act, which went into effect on January 1, 2025. This law aims to protect the personal information of New Hampshire residents while also considering the needs of businesses.

Key Provisions of the New Hampshire Privacy Act:

  • Consumer Rights:

    • Right to Access: Consumers can request access to their personal data.

    • Right to Correction: Consumers can request correction of inaccurate personal data.

    • Right to Delete: Consumers can request deletion of their personal data.

    • Right to Opt-Out: Consumers can opt-out of the sale of their personal data.

  • Business Obligations:

    • Provide a Privacy Notice: Clearly inform consumers about your data practices.

    • Respond to Consumer Requests: Respond to consumer requests within 60 days.

    • Implement Reasonable Security: Protect personal data with appropriate security measures.

    • Obtain Consent: Obtain consent before processing sensitive data.

  • Sensitive Data:

    • The New Hampshire law defines "sensitive data" as information revealing an individual's racial or ethnic origin, religious beliefs, mental or physical health condition, sex life or sexual orientation, or citizenship1 or immigration status. Businesses must obtain consent to process this type of data.

Who does the New Hampshire Privacy Act apply to?

The New Hampshire Privacy Act applies to businesses that conduct business in New Hampshire or provide products or services to New Hampshire residents and meet one of the following thresholds:

  • Control or process the personal data of at least 100,000 consumers.

  • Derive 50% or more of their gross revenue from selling personal data.

What makes the New Hampshire Privacy Act unique?

  • No Private Right of Action: Unlike some other state privacy laws, the New Hampshire Privacy Act does not give consumers the right to sue businesses for violations. Only the Attorney General can enforce the law.

  • Limited Definition of "Sale": The law defines "sale" more narrowly than some other states, focusing on the exchange of personal data for monetary consideration.

  • No Data Protection Assessments: The law does not require businesses to conduct data protection assessments.

Why is the New Hampshire Privacy Act important?

The New Hampshire Privacy Act represents a significant step in protecting consumer data privacy in the state. While it may not be as comprehensive as some other state laws, it still imposes important obligations on businesses and provides consumers with valuable rights.

How Aetos Can Help:

Aetos Data Consulting provides expert guidance and support to help businesses navigate the complexities of the New Hampshire Privacy Act. Our services include:

  • Compliance audits

  • Policy development and implementation

  • Training and awareness programs

  • Data subject request management

Contact us today to learn more about how we can help your business with the New Hampshire Privacy Act and other data privacy issues.

Check out other state laws