On March 6, 2024, Governor Chris Sununu signed Senate Bill 255, making New Hampshire the 14th U.S. state to enact a comprehensive privacy law (NHDPA) and the second in 2024 after New Jersey.
Modeled after laws like those in California and Colorado, the NHDPA grants consumers privacy rights over their personal data and allows a 60-day cure period for violations. It takes effect on January 1, 2025, and is enforced exclusively by the Attorney General.
NHDPA outlines several obligations for organizations, such as data minimization and purpose limitation, non-discrimination, security measures, consent requirements and privacy notice requirements, opt-out signal preferences, and conducting data protection assessments and requirements for processors, among several other requirements. It also gives data subjects rights, such as access, correct, delete, data portability, and opt-out.