Navigating the New Hampshire's Data Privacy Law (NHDPA): Key Details

The NHDPA applies to businesses targeting New Hampshire residents that, within a year, process the personal data of 35,000+ consumers (excluding payment-related data) or 10,000+ consumers while earning over 25% of revenue from data sales.

The New Hampshire Attorney General exclusively enforces the NHDPA. From January 1 to December 31, 2025, the AG was required to issue a notice of violation before taking action if a cure was possible. Controllers had 60 days to resolve the issue, after which the AG could proceed with enforcement. After this period, issuing a cure notice is at the Attorney General’s discretion.

Controllers must respond to consumer requests within 45 days, extendable by another 45 days if necessary, with reasons for delays communicated to the consumer. Controllers must notify the consumer within 45 days if a request is declined, providing reasons and appeal instructions.