What Is the New Hampshire Data Privacy Act?
NHDPA applies to controllers that conduct business in New Hampshire or target New Hampshire residents and meet its 35,000-consumer or 10,000-consumer-plus-more-than-25%-sale-revenue threshold, subject to exceptions. Rights include delete, access, correct, port, and opt-out. Controllers must allow qualifying opt-out preference signals for targeted advertising or sale from January 1, 2025, and generally respond within 45 days with a possible 45-day extension. Enforcement is exclusive to the AG, with civil penalties under RSA 358-A; from January 1, 2026, any cure opportunity is discretionary under statutory factors.
At a glance
- Full name
- New Hampshire Data Privacy Act
- Short code
- NHDPA
- Effective date
- January 1, 2025
- Response reference
- 45 days in this snapshot
- Cure period
- None recorded in this snapshot
- Private right of action
- No
- Enforcement
- New Hampshire Department of Justice. Consumer Protection Bureau
- Penalty reference
- Up to $10,000 per violation under RSA 358-A:4
- Statutory citation
- N.H. Rev. Stat. §§ 507-H:1–507-H:12
Who NHDPA applies to
A business is covered if it meets the applicability thresholds set out in N.H. Rev. Stat. §§ 507-H:1–507-H:12. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Conducts business in New Hampshire or targets New Hampshire residents and, during a one-year period, controls or processes the personal data of at least 35,000 unique consumers, excluding data processed solely to complete a payment transaction
- Conducts business in New Hampshire or targets New Hampshire residents and, during a one-year period, controls or processes the personal data of at least 10,000 unique consumers and derives more than 25% of gross revenue from the sale of personal data
Consumer rights under NHDPA
Delete, access, correct, port, opt-out
Universal opt-out mechanism recognition (GPC)
AG enforcement via Consumer Protection Act
Notable features (vs. CCPA)
NHDPA requires covered controllers to recognize qualifying opt-out preference signals for targeted advertising and sale no later than January 1, 2025. For consumers the controller knows, or willfully disregards, are at least 13 but younger than 16, consent is required for targeted advertising or sale; COPPA rules also apply to known children. An enacted 2026 amendment prohibiting sale of a child's personal data is scheduled for January 1, 2027 and is not described as current law here.
Enforcement and penalty reference
Enforcing agency: New Hampshire Department of Justice. Consumer Protection Bureau
Penalty reference: Up to $10,000 per violation under RSA 358-A:4
Cure period: From January 1, 2026, the Attorney General may consider statutory factors when deciding whether to offer a cure opportunity. If a cure is offered, the statute provides 60 days after notice; there is no automatic current cure right.
Private right of action: NHDPA has no private right of action. Enforcement is through the New Hampshire Department of Justice. Consumer Protection Bureau.
Where to file a complaint: New Hampshire Department of Justice. Consumer Protection
How to exercise your NHDPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable New Hampshire residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the New Hampshire Department of Justice. Consumer Protection complaint route at https://www.doj.nh.gov/consumer-protection. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a NHDPA privacy request, $9 one-time
FAQ
Does GPC work in New Hampshire?+
New Hampshire requires qualifying opt-out preference signals, including a suitable Global Privacy Control signal, for sale and targeted advertising from January 1, 2025. This is an opt-out preference, not proof that an existing profile was deleted; review the controller's current notice and signal handling.
Official sources & citations
Compare with sibling state laws
NHDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: