On March 6, 2024, Governor Chris Sununu signed Senate Bill 255, making New Hampshire the 14th U.S. state to enact a comprehensive privacy law, the New Hampshire Data Privacy Act (NHDPA). It became the second state in 2024 to pass such a law, following New Jersey.
The NHDPA applies to businesses operating in the state or targeting products and services to New Hampshire residents if they meet one of two conditions in a given year: they control or process the personal data of at least 35,000 consumers (excluding data used solely for payment transactions), or they control or process the personal data of at least 10,000 consumers and derive more than 25% of their gross revenue from selling personal data.
The NHDPA is modeled after other state privacy laws, like those in Colorado and California, and grants consumers rights over their personal data, including its collection, processing, and sale. The state's Attorney General enforces the law, which originally included a 60-day cure period for violations. The law came into effect on January 1, 2025. Starting January 1, 2025, the cure period is provided at the attorney general’s discretion, taking into account factors such as the number of violations, nature of processing activities, and the size and complexity of the controller or processor.
