New Hampshire Privacy Act (NHPA)

New Hampshire's comprehensive privacy law, effective 1 January 2025. HB 1460 prohibits the sale of personal data of children under 13 from 1 January 2027.

JurisdictionNew Hampshire
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The New Hampshire Data Privacy Act (NHPA) establishes several key requirements for businesses that process personal data of New Hampshire residents:

  • Data Minimization: Controllers must limit data collection to what is "adequate, relevant, and reasonably necessary" for the stated purposes of processing. Source: New Hampshire General Court
  • Consumer Rights: The NHPA grants consumers the rights to access, correct, delete, and obtain a copy of their personal data, as well as opt out of data processing for targeted advertising, sale, or profiling. Source: New Hampshire Attorney General's Office
  • Consent for Sensitive Data: Controllers must obtain explicit consent before processing sensitive personal data, including data of children aged 13-16. Source: New Hampshire General Court
  • Data Protection Assessments: Controllers must conduct data protection impact assessments for processing activities that present heightened risks to consumers. Source: New Hampshire General Court

Compliance Challenges

Organizations face several challenges in complying with the NHPA:

  • Data Mapping and Inventory: Many businesses struggle to identify and categorize all personal data they process, making it difficult to fulfill consumer rights requests. Source: IAPP Privacy Tracker
  • Implementing Opt-Out Mechanisms: Providing user-friendly methods for consumers to opt out of data processing can be technically complex. Source: Future of Privacy Forum
  • Third-Party Risk Management: Ensuring compliance across vendor relationships and data sharing agreements is often challenging. Source: Gartner Research

Implementation Best Practices

To effectively implement NHPA requirements:

  • Implement a comprehensive consent management platform to obtain and track user consent. Source: OneTrust
  • Develop clear data retention and deletion policies to ensure timely compliance with consumer deletion requests. Source: IAPP Resource Center

Recent Updates

As of February 2025, there have been no significant amendments to the NHPA since its enactment. However:

Related Regulations

The NHPA shares similarities with other state privacy laws:

Industry Impact

The NHPA will significantly impact various industries:

  • Retail and E-commerce: These sectors will need to revamp data collection practices and provide clear opt-out mechanisms for targeted advertising. Source: National Retail Federation

Sources

Recent developments

  • — New Hampshire Attorney General’s Office publishes guidance on the New Hampshire consumer data privacy law (SB 255), now in effect as of January 1, 2025, detailing consumer rights and business obligations under the New Hampshire Privacy Act / Consumer Expectation of Privacy Act.[3] (source)
  • — Guidance emphasizes consumers’ rights to access, correct, delete, obtain copies of their data, and opt out of targeted advertising, sale, and profiling, while clarifying businesses’ 45‑day response timelines and compliance expectations.[3] (source)
  • — TrustArc issues an implementation overview of the New Hampshire Consumer Expectation of Privacy Act (NHPA), focusing on enforcement from January 1, 2025 and the operational requirements for controllers, including honoring opt‑out requests and conducting data protection assessments.[7] (source)
  • — The piece highlights the Attorney General’s exclusive enforcement authority, absence of a private right of action, and industry obligations around sensitive data opt‑in, children’s data, targeted advertising disclosures, and non‑discrimination, signaling moderate but concrete compliance impacts for businesses operating in New Hampshire.[7] (source)
  • — Industry privacy vendors position NHPA as broadly aligned with other state comprehensive privacy laws (e.g., Colorado and Connecticut), noting that organizations with mature U.S. privacy programs can leverage existing frameworks and primarily need to adjust thresholds, notices, and opt‑out mechanisms for New Hampshire residents.[7] (source)
  • — Osano publishes updated NHPA compliance guidance ahead of and immediately following the January 1, 2025 effective date, outlining applicability thresholds (35,000/10,000‑consumer triggers) and the one‑year cure period through 2025, which allows remediation within 60 days before penalties are imposed.[2] (source)
  • — The article stresses practical impacts on data‑driven businesses and ad‑tech, including requirements around consumer rights handling, profiling limitations, and transparency in privacy notices, and frames NHPA as part of the growing patchwork of state privacy laws that multi‑state controllers must harmonize.[2] (source)
  • — Hunton Andrews Kurth issues a post‑effective‑date analysis of SB 255/NHPA, describing New Hampshire as the 15th state with a comprehensive privacy law and detailing controller obligations, consumer rights, and timelines for responding to rights requests.[6] (source)
  • — Koley Jessen’s update compares NHPA to the Connecticut Data Privacy Act, stressing opt‑in consent for sensitive data and data protection assessment requirements, signaling that organizations already compliant with Connecticut and other modern state laws face incremental rather than transformative changes.[4] (source)
  • — A bill amending the New Hampshire Privacy Act was introduced in the House and referred to the Judiciary Committee. The proposal would define “personal information” more specifically than the current law, potentially expanding the categories covered. (source)
  • — White & Case publishes a client alert around the NHPA’s January 1, 2025 effective date, summarizing scope, rights, controller duties, and enforcement, and advising businesses to align privacy notices, data‑protection assessments, and opt‑out processes to avoid Attorney General enforcement once the cure period expires.[1] (source)
  • — The New Hampshire Attorney General’s Office published guidance on the state’s consumer data privacy law as it took effect. The guidance reiterated consumer rights such as access, correction, deletion, portability, and opt-out rights, and noted businesses have 45 days to respond to consumer requests. (source)

Read the full guide to New Hampshire Privacy Act (NHPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates