New Hampshire Privacy Law

New Hampshire (NHDPA)

Last updated Sep 29, 2026

NHDPA Enacted, in effect

Who this affects: This page tracks New Hampshire’s NHDPA, which governs controllers and processors.

Who it applies to: Persons that do business in New Hampshire or target its residents, and meet: 35,000+ consumers, or 10,000+ consumers and more than 25% of gross revenue from selling data.

Content on this page is not legal advice

Must, Can't, Should NHDPA Timeline

Jan 1, 2025

Effective ↗

Attorney General

Enforced by ↗

$10,000

Maximum penalty per violation ↗

None

Private right of action ↗

The law, in plain English

Must · Can’t · Should

NHDPA, distilled to what actually changes your week. Read one column to know your floor, your hard limits, and the further obligations and good practices worth planning for.

Must

Respond to rights requests within 45 days, and if you decline, explain why and give instructions for how to appeal. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:4 “A controller shall respond to the consumer without undue delay, but not later than 45 days after receipt of the request” Read the statute NH-507-H:4 “the controller shall inform the consumer without undue delay, but not later than 45 days after receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision” Read the statute
Honor opt-out preference signals, such as GPC, for targeted advertising and sale, and post a clear opt-out webpage link. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:6 “allowing a consumer to opt-out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer's consent, by a platform, technology, or mechanism to the controller indicating such consumer's intent to opt-out of any such processing or sale” Read the statute NH-507-H:6 “the controller shall comply with such consumer's opt-out preference signal, but may notify such consumer of such conflict and provide to such consumer the choice to confirm such controller-specific privacy setting or participation in such program” Read the statute NH-507-H:6 “Providing a clear and conspicuous link on the controller's Internet website to an Internet webpage that enables a consumer, or an agent of the consumer, to opt-out of the targeted advertising or sale of the consumer's personal data” Read the statute
Bind each processor by a contract setting out instructions, purpose, data type, duration, and both parties' rights and duties. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:7 “A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller. The contract shall be binding and clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing and the rights and obligations of both parties.” Read the statute

Can't

Process sensitive data without consumer consent, or a known child's sensitive data other than in accordance with COPPA. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:6 “Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with COPPA” Read the statute
Target ads with or sell data of a consumer you know and wilfully disregard is at least 13 but younger than 16, without consent. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:6 “Not process the personal data of a consumer for purposes of targeted advertising, or sell the consumer's personal data without the consumer's consent, under circumstances where a controller has actual knowledge, and wilfully disregards, that the consumer is at least 13 years of age but younger than 16 years of age” Read the statute
Discriminate against a consumer for exercising rights, such as by denying goods or services, or require a new account to do so. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:6 “A controller shall not discriminate against a consumer for exercising any of the consumer rights contained in this chapter, including denying goods or services, charging different prices or rates for goods or services or providing a different level of quality of goods or services to the consumer. II. Nothing in this section shall be construed to require a controller to provide a product or service that requires the personal data of a consumer which the controller does not collect or maintain, or prohibit a controller from offering a different price, rate, level, quality or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts or club card program” Read the statute NH-507-H:6 “A controller shall not require a consumer to create a new account in order to exercise consumer rights, but may require a consumer to use an existing account” Read the statute

Should

Track requests per consumer so the information you provide in response is free of charge once in any twelve-month period. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:4 “Information provided in response to a consumer request shall be provided by a controller, free of charge, once per consumer during any twelve-month period” Read the statute
If a request needs more time, tell the consumer of the extension and its reason within the initial 45-day response period. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:4 “provided the controller informs the consumer of any such extension within the initial 45-day response period and of the reason for the extension.” Read the statute
Make revoking consent at least as easy as giving it, and stop processing as soon as practicable, within 15 days of the request. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NH-507-H:6 “Provide an effective mechanism for a consumer to revoke the consumer's consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer's consent and, upon revocation of such consent, cease to process the data as soon as practicable, but not later than 15 days after the receipt of such request” Read the statute

These are the highlights we judge most important, not everything NHDPA requires. The comprehensive law section below covers the full detail, fact by fact, with the statutory text behind every one.

The comprehensive law

New Hampshire Data Privacy Act

NHDPA (SB 255) is New Hampshire’s comprehensive privacy law. Every fact was extracted from the primary statute by the DataGrail regulation engine and is grounded to the cited source. Scan the facts; the exact statutory text sits one click away on each source link.

Status

Enacted, in effect

Archived excerpt — the text we read … "Third-party" means an individual or legal entity, such as a public authority, agency, or body, other than the consumer, controller, or processor, or an affiliate of the processor or the controller. Source. 2024, 5:1, eff. Jan. 1, 2025; 229:2, eff. Jan. 1, 2025 at 12:01 a.m. Section 507-H:2 Archived from source — captured 2026-08-03 · snapshot a6c913f3 Verify at the source

Corroborated by Privacy-law tracker

Effective

January 1, 2025

Corroborated by Privacy-law tracker Regulator guidance

Signed

March 6, 2024

“Signed by the Governor on 03/06/2024; Chapter 0005; Effective 01/01/2025” View the source

Enforced by

Attorney General

Archived excerpt — the text we read 507-H:11 Notice; Enforcement. – I. The attorney general shall have exclusive authority to enforce violations under this chapter. II. During the period beginning January 1, 2025 and ending December 31, 2025, the attorney general shall, and following said period the attorney general may, prior to initiating any action for a violation under this ch… Archived from source — captured 2026-08-03 · snapshot a6c913f3 Verify at the source

Maximum penalty per violation

$10,000

Counted per unlawful act; a good-faith misunderstanding is a defense. Criminal liability only on conviction. “the court may make any necessary order or judgment and may award to the state civil penalties up to $10,000 for each violation of this chapter” View the statute

Right to cure

Mandatory cure lapsed Dec 31, 2025; now discretionary

Mandatory in 2025; since Jan 1, 2026 the AG may offer a 60-day cure. RSA 358-A:5 also requires 10 days' notice. Archived excerpt — the text we read 507-H:11 Notice; Enforcement. – I. The attorney general shall have exclusive authority to enforce violations under this chapter. II. During the period beginning January 1, 2025 and ending December 31, 2025, the attorney general shall, and following said period the attorney general may, prior to initiating any action for a violation under this chapter, issue a notice of violation to the controller if the attorney general determines that a cure is possible. If the controller fails to cure such violation within 60 days of receipt of the notice of violation, the attorney general may bring an action pursuant to this section. III. Beginning January 1, 2026, in determining whether to grant a controller or processor the opportunity to cure an alleged violation described under this chapter, the attorney general may consider: (1) The number of… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source

Private right of action

No private right of action.

Archived excerpt — the text we read …essor's processing activities; (4) The substantial likelihood of injury to the public; (5) The safety of persons or property; and (6) Whether such alleged violation was likely caused by human or technical error. IV. Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations under this chapter or any other law. V. A violation under this chapter shall constitute an unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within this state under RSA 358-A:2 and shall be enf… Archived from source — captured 2026-08-03 · snapshot a6c913f3 Verify at the source

Corroborated by Privacy-law tracker Regulator guidance

Universal opt-out signal

Required

Archived excerpt — the text we read …er's Internet website to an Internet webpage that enables a consumer, or an agent of the consumer, to opt-out of the targeted advertising or sale of the consumer's personal data; and (B) Not later than January 1, 2025, allowing a consumer to opt-out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer's consent, by a platform, technology, or mechanism to the controller indicating such consumer's intent to opt-out of any such processing or sale. Such platform, technology, or mechanism shall: (i) Not unfairly disadvantage another controller; (ii) Not make use of a default setting, but… Archived from source — captured 2026-08-03 · snapshot a6c913f3 Verify at the source

Corroborated by Privacy-law tracker

What the law gives consumers

Right to access Archived excerpt — the text we read 507-H:4 Consumer Expectation of Privacy. – I. A consumer shall have the right to: (a) Confirm whether or not a controller is processing the consumer's personal data and access such personal data, unless such confirmation or access would require the controller to reveal a trade secret; (b) Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (c) Delete personal data provided by, … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Right to correct Archived excerpt — the text we read …right to: (a) Confirm whether or not a controller is processing the consumer's personal data and access such personal data, unless such confirmation or access would require the controller to reveal a trade secret; (b) Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (c) Delete personal data provided by, or obtained about, the consumer; (d) Obtain a copy of the consumer's personal data processed by the controller, in a portable and, to the extent technically feasible, readily usa… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Right to delete Archived excerpt — the text we read …ontroller to reveal a trade secret; (b) Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (c) Delete personal data provided by, or obtained about, the consumer; (d) Obtain a copy of the consumer's personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another cont… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Right to data portability Archived excerpt — the text we read …sumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (c) Delete personal data provided by, or obtained about, the consumer; (d) Obtain a copy of the consumer's personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided such controller shall not be required to reveal any trade secret; and (e) Opt-out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, except as provided in RSA 507-H:6, or profiling in furtherance of solely automated decisions that… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Right to opt out of sale Archived excerpt — the text we read …lows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided such controller shall not be required to reveal any trade secret; and (e) Opt-out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, except as provided in RSA 507-H:6, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. II. A consumer may exercise rights under this section by any secure and reliable m… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Right to opt out of targeted advertising Archived excerpt — the text we read …lows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided such controller shall not be required to reveal any trade secret; and (e) Opt-out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, except as provided in RSA 507-H:6, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. II. A consumer may exercise rights under this section by any secure and reliable m… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Right to opt out of profiling for solely automated significant decisions Archived excerpt — the text we read …ch controller shall not be required to reveal any trade secret; and (e) Opt-out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, except as provided in RSA 507-H:6, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. II. A consumer may exercise rights under this section by any secure and reliable means described to the consumer in the controller's privacy notice. A consumer may designate an authorized agent in accordance with RSA … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Sensitive data: opt-in consent required Archived excerpt — the text we read …onable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal data appropriate to the volume and nature of the personal data at issue; (d) Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with COPPA; (e) Not process personal data in violation of the laws of this state and federal law… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Right to appeal Archived excerpt — the text we read …s and not using such retained data for any other purpose pursuant to this chapter, or opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant this chapter. IV. A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision. The appeal process shall be conspicuously available and similar to the process for submitting requests to initiate action pursuant to this section. Not later than 60 days after receipt of an appeal, a controller shall i… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Right against discrimination Archived excerpt — the text we read …sumer's personal data without the consumer's consent, under circumstances where a controller has actual knowledge, and wilfully disregards, that the consumer is at least 13 years of age but younger than 16 years of age. A controller shall not discriminate against a consumer for exercising any of the consumer rights contained in this chapter, including denying goods or services, charging different prices or rates for goods or services or providing a different level of quality of goods or services to the consumer. II. Nothing in this section shall be construed to require a controller to provide a product or service that requires the personal data of a consumer which the controller does not collect or maintain, or prohibit a cont… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Not granted: Private right of action Archived excerpt — the text we read …essor's processing activities; (4) The substantial likelihood of injury to the public; (5) The safety of persons or property; and (6) Whether such alleged violation was likely caused by human or technical error. IV. Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations under this chapter or any other law. V. A violation under this chapter shall constitute an unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within this state under RSA 358-A:2 and shall be enf… Archived from source — captured 2026-08-03 · snapshot a6c913f3 Verify at the source

Who the law governs

Controllers Archived excerpt — the text we read …vernment agency whose communications or transactions with the controller occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit or government agency. IX. "Controller" means an individual who, or legal entity that, alone or jointly with others determines the purpose and means of processing personal data. X. "COPPA" means the Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501, et seq., and any amendments, regulations, rules, guidance and exemptions adopted under that act. XI. "Covered entity" has the same… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Processors Archived excerpt — the text we read … of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion or modification of personal data. XXII. "Processor" means an individual who, or legal entity that, processes personal data on behalf of a controller. XXIII. "Profiling" means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, p… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source

Exemptions

State and local government agencies Archived excerpt — the text we read 507-H:3 Exclusions. – I. This chapter shall not apply to any: (a) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (b) Nonprofit organization; (c) Institution of higher education; (d) National securities association that is registered under 15 U.S.C. section 78o-3 of the Securities Exchange Act of 1934, as amended; (e) Financia… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Nonprofit organizations Archived excerpt — the text we read 507-H:3 Exclusions. – I. This chapter shall not apply to any: (a) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (b) Nonprofit organization; (c) Institution of higher education; (d) National securities association that is registered under 15 U.S.C. section 78o-3 of the Securities Exchange Act of 1934, as amended; (e) Financial institution or data subject… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Institutions of higher education Archived excerpt — the text we read …3 Exclusions. – I. This chapter shall not apply to any: (a) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (b) Nonprofit organization; (c) Institution of higher education; (d) National securities association that is registered under 15 U.S.C. section 78o-3 of the Securities Exchange Act of 1934, as amended; (e) Financial institution or data subject to Title V of the Gramm-Leach-Bliley … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
National securities associations Archived excerpt — the text we read … not apply to any: (a) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (b) Nonprofit organization; (c) Institution of higher education; (d) National securities association that is registered under 15 U.S.C. section 78o-3 of the Securities Exchange Act of 1934, as amended; (e) Financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq.; or, (f) A covered entity or business associate, as defined in 45 C.F.R. 160.103.(b). II. The following info… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Financial institutions and data subject to GLBA Title V (entity- and data-level) Entity- and data-level Archived excerpt — the text we read …is state; (b) Nonprofit organization; (c) Institution of higher education; (d) National securities association that is registered under 15 U.S.C. section 78o-3 of the Securities Exchange Act of 1934, as amended; (e) Financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq.; or, (f) A covered entity or business associate, as defined in 45 C.F.R. 160.103.(b). II. The following information and data shall be exempt from this chapter: (a) Protected health information under HIPAA; (b) Patie… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
HIPAA covered entities and business associates Archived excerpt — the text we read … that is registered under 15 U.S.C. section 78o-3 of the Securities Exchange Act of 1934, as amended; (e) Financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq.; or, (f) A covered entity or business associate, as defined in 45 C.F.R. 160.103.(b). II. The following information and data shall be exempt from this chapter: (a) Protected health information under HIPAA; (b) Patient-identifying information for purposes of 42 U.S.C. section 290dd-2; (c) Identifiable… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Protected health information under HIPAA Archived excerpt — the text we read …f the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq.; or, (f) A covered entity or business associate, as defined in 45 C.F.R. 160.103.(b). II. The following information and data shall be exempt from this chapter: (a) Protected health information under HIPAA; (b) Patient-identifying information for purposes of 42 U.S.C. section 290dd-2; (c) Identifiable private information for purposes of the federal policy for the protection of human subjects under 45 C.F.R. 46; (d) Ide… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Patient-identifying information Archived excerpt — the text we read … seq.; or, (f) A covered entity or business associate, as defined in 45 C.F.R. 160.103.(b). II. The following information and data shall be exempt from this chapter: (a) Protected health information under HIPAA; (b) Patient-identifying information for purposes of 42 U.S.C. section 290dd-2; (c) Identifiable private information for purposes of the federal policy for the protection of human subjects under 45 C.F.R. 46; (d) Identifiable private information that is otherwise information collected as part of… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Human subjects research information under federal policy Archived excerpt — the text we read …160.103.(b). II. The following information and data shall be exempt from this chapter: (a) Protected health information under HIPAA; (b) Patient-identifying information for purposes of 42 U.S.C. section 290dd-2; (c) Identifiable private information for purposes of the federal policy for the protection of human subjects under 45 C.F.R. 46; (d) Identifiable private information that is otherwise information collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the International Council for Harmonization o… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Human subjects research under good clinical practice guidelines Archived excerpt — the text we read …PAA; (b) Patient-identifying information for purposes of 42 U.S.C. section 290dd-2; (c) Identifiable private information for purposes of the federal policy for the protection of human subjects under 45 C.F.R. 46; (d) Identifiable private information that is otherwise information collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use; (e) The protection of human subjects under 21 C.F.R. Parts 6, 50, and 56, or personal data used or shared in research, as defined in 45 C.F.R. 164.501, that is conducted in accordance with the standards set forth in t… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Human subjects data under FDA regulations, and others Human subjects data under FDA regulations, personal data used or shared in HIPAA-defined research, or other research conducted in accordance with applicable law. 21 C.F.R. Parts 6, 50, 56. 45 C.F.R. 164.501. Archived excerpt — the text we read …tion collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use; (e) The protection of human subjects under 21 C.F.R. Parts 6, 50, and 56, or personal data used or shared in research, as defined in 45 C.F.R. 164.501, that is conducted in accordance with the standards set forth in this chapter, or other research conducted in accordance with applicable law; (f) Information and documents created for purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq.; (g) Patient safety work product for purposes of the Patient Safety and Quality Improveme… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Health Care Quality Improvement Act information Archived excerpt — the text we read …ersonal data used or shared in research, as defined in 45 C.F.R. 164.501, that is conducted in accordance with the standards set forth in this chapter, or other research conducted in accordance with applicable law; (f) Information and documents created for purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq.; (g) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act, 42 U.S.C. 299b-21 et seq., as amended; (h) Information derived from any of the health care related information listed in… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Patient safety work product Archived excerpt — the text we read …forth in this chapter, or other research conducted in accordance with applicable law; (f) Information and documents created for purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq.; (g) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act, 42 U.S.C. 299b-21 et seq., as amended; (h) Information derived from any of the health care related information listed in this subsection that is de-identified in accordance with the requirements for de-identification pursuant to HIPAA; (i) Information ori… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
HIPAA de-identified health information Archived excerpt — the text we read …s of the Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq.; (g) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act, 42 U.S.C. 299b-21 et seq., as amended; (h) Information derived from any of the health care related information listed in this subsection that is de-identified in accordance with the requirements for de-identification pursuant to HIPAA; (i) Information originating from and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this section that is maintained by a covered entity or business as… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Information intermingled with exempt information When maintained by a HIPAA covered entity/business associate or a 42 U.S.C. § 290dd-2 program/qualified service organization. Archived excerpt — the text we read …eq., as amended; (h) Information derived from any of the health care related information listed in this subsection that is de-identified in accordance with the requirements for de-identification pursuant to HIPAA; (i) Information originating from and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this section that is maintained by a covered entity or business associate, program or qualified service organization, as specified in 42 U.S.C. 290dd-2, as amended; (j) Information used for public health activities and purposes as authorized by HIPAA, community health activities and population health activities; (k) The collection, maintenance, disclosure, sale, communication or… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Public health activities information Archived excerpt — the text we read …d in the same manner as, information exempt under this section that is maintained by a covered entity or business associate, program or qualified service organization, as specified in 42 U.S.C. 290dd-2, as amended; (j) Information used for public health activities and purposes as authorized by HIPAA, community health activities and population health activities; (k) The collection, maintenance, disclosure, sale, communication or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
FCRA-regulated data Archived excerpt — the text we read …ice organization, as specified in 42 U.S.C. 290dd-2, as amended; (j) Information used for public health activities and purposes as authorized by HIPAA, community health activities and population health activities; (k) The collection, maintenance, disclosure, sale, communication or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living by a consumer reporting agency, furnisher or user that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.; (l) Personal data collected, processed, sold or disclosed in compliance with the Driver's Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as amended; (m) Personal data regulated by the Family Educational Righ… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Driver's Privacy Protection Act data Archived excerpt — the text we read …es information for use in a consumer report, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.; (l) Personal data collected, processed, sold or disclosed in compliance with the Driver's Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as amended; (m) Personal data regulated by the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g et seq., as amended; (n) Personal data collected, processed, sold or disclosed in compliance with the Farm Credit Act, 12 … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
FERPA-regulated data Archived excerpt — the text we read … the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.; (l) Personal data collected, processed, sold or disclosed in compliance with the Driver's Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as amended; (m) Personal data regulated by the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g et seq., as amended; (n) Personal data collected, processed, sold or disclosed in compliance with the Farm Credit Act, 12 U.S.C. 2001 et seq., as amended; (o) Data processed or maintained in the course of an individual applying to, emplo… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Farm Credit Act data Archived excerpt — the text we read …n compliance with the Driver's Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as amended; (m) Personal data regulated by the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g et seq., as amended; (n) Personal data collected, processed, sold or disclosed in compliance with the Farm Credit Act, 12 U.S.C. 2001 et seq., as amended; (o) Data processed or maintained in the course of an individual applying to, employed by or acting as an agent or independent contractor of a controller, processor or third party, to the extent that the data is collec… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Employment data Archived excerpt — the text we read …Family Educational Rights and Privacy Act, 20 U.S.C. 1232g et seq., as amended; (n) Personal data collected, processed, sold or disclosed in compliance with the Farm Credit Act, 12 U.S.C. 2001 et seq., as amended; (o) Data processed or maintained in the course of an individual applying to, employed by or acting as an agent or independent contractor of a controller, processor or third party, to the extent that the data is collected and used within the context of that role; as the emergency contact information of an individual under this chapter used for emergency contact purposes; or, that is necessary to retain to administer benefits for another individual relating to the individual who… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Emergency contact information Archived excerpt — the text we read …rse of an individual applying to, employed by or acting as an agent or independent contractor of a controller, processor or third party, to the extent that the data is collected and used within the context of that role; as the emergency contact information of an individual under this chapter used for emergency contact purposes; or, that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under HIPPA and used for the purposes of administering such benefits; (p) … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Benefits administration data Archived excerpt — the text we read …cessor or third party, to the extent that the data is collected and used within the context of that role; as the emergency contact information of an individual under this chapter used for emergency contact purposes; or, that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under HIPPA and used for the purposes of administering such benefits; (p) Personal data collected, processed, sold or disclosed in relation to price, route or service, as such terms are used in the Airline Deregulation Act, 49 U.S.C. 40101 et seq., as amended, by an air carrier subject … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Airline Deregulation Act preempted data Archived excerpt — the text we read …; or, that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under HIPPA and used for the purposes of administering such benefits; (p) Personal data collected, processed, sold or disclosed in relation to price, route or service, as such terms are used in the Airline Deregulation Act, 49 U.S.C. 40101 et seq., as amended, by an air carrier subject to the act, to the extent this chapter is preempted by the Airline Deregulation Act, 49 U.S.C. 41713, as amended; (q) Personal information maintained or used for purposes of compliance with the regulation of listed chemicals under the federal Controlled Substances Act, 21 U.S.C. section 830; and (r) Information included in a lim… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Controlled Substances Act listed chemicals data Archived excerpt — the text we read …used in the Airline Deregulation Act, 49 U.S.C. 40101 et seq., as amended, by an air carrier subject to the act, to the extent this chapter is preempted by the Airline Deregulation Act, 49 U.S.C. 41713, as amended; (q) Personal information maintained or used for purposes of compliance with the regulation of listed chemicals under the federal Controlled Substances Act, 21 U.S.C. section 830; and (r) Information included in a limited data set as described at 45 C.F.R. 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified at 45 C.F.R. 164.514(e). III. Con… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
HIPAA limited data set Archived excerpt — the text we read …, 49 U.S.C. 41713, as amended; (q) Personal information maintained or used for purposes of compliance with the regulation of listed chemicals under the federal Controlled Substances Act, 21 U.S.C. section 830; and (r) Information included in a limited data set as described at 45 C.F.R. 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified at 45 C.F.R. 164.514(e). III. Controllers and processors that comply with the verifiable parental consent requirements of COPPA shall be compliant with any obligation to obtain parental consent pursuant to this chapter. Source. 2024, 5:1, ef… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Purely personal or household activity Archived excerpt — the text we read …cts the rights or freedoms of any person, including, but not limited to, the rights of any person to freedom of speech or freedom of the press guaranteed in the First Amendment to the United States Constitution; or (b) Apply to any person's processing of personal data in the course of such person's purely personal or household activities. VI. Personal data processed by a controller pursuant to this section may be processed to the extent that such processing is: (a) Reasonably necessary and proportionate to the purposes listed in this section; and (b) … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Evidentiary privilege (compliance would violate a New Hampshire evidentiary privilege) Archived excerpt — the text we read …ler, or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party. III. The obligations imposed on controllers or processors under this chapter shall not apply where compliance by the controller or processor with said sections would violate an evidentiary privilege under the laws of this state. Nothing in this chapter shall be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of the state as part of … Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Privileged communications to a person covered by an evidentiary privilege Archived excerpt — the text we read …obligations imposed on controllers or processors under this chapter shall not apply where compliance by the controller or processor with said sections would violate an evidentiary privilege under the laws of this state. Nothing in this chapter shall be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of the state as part of a privileged communication. IV. A controller or processor that discloses personal data to a processor or third-party controller in accordance with this chapter shall not be deemed to have violated said sections if the processor or third-party con… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source
Rights and freedoms of others, including free speech and press Archived excerpt — the text we read …n violation of said sections for the transgressions of the controller or processor from which such third-party controller or processor receives such personal data. V. Nothing in this chapter shall be construed to: (a) Impose any obligation on a controller or processor that adversely affects the rights or freedoms of any person, including, but not limited to, the rights of any person to freedom of speech or freedom of the press guaranteed in the First Amendment to the United States Constitution; or (b) Apply to any person's processing of personal data in the course of such person's purely personal or household activities. VI. Personal data processed by a controller pursuant to this section may be processed t… Archived from source — captured 2026-09-18 · snapshot 5046ff8b Verify at the source

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source.

Timeline

NHDPA milestones

This state currently has one dated milestone on the books.

Enforcement January 1, 2025

NHDPA took effect

Enforcement began — obligations have been live since this date.

Source: primary citation

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source. Reference only, not legal advice.

Status Signed Maximum penalty per violation Status — Privacy-law tracker Effective — Regulator guidance Private right of action — Privacy-law tracker

When staying on top of the law isn't enough, DataGrail automates the work.

DSR automation and regulatory tracking — handled by the platform behind this reference.

How DataGrail helps

Back to the Regulations Hub Reference only — not legal advice. Published Sep 29, 2026