LexLint

Know the law your code answers to.

Law / United States / New Hampshire

Notice of Security Breach

RSA 359-C:19-21

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 January 2007.

A breach notification rule binding public and private bodies.

As of 2 September 2026.

What it requires

  • Notify affected New Hampshire residents and the Attorney General's office as soon as possible on determining a security breach of personal information occurred.
  • Notify consumer reporting agencies once notice is required for more than 1,000 residents.
  • Expect an injured individual to be able to sue for damages, including treble damages for a willful or knowing violation, unlike New Hampshire's comprehensive privacy act.

If you get it wrong

Criminal exposureNo

Private right of actionYes

Penalty structure

This civil penalty, sought by the Attorney General under RSA 358-A:4 as invoked by RSA 359-C:21, II, is separate from the actual damages (doubled or trebled for a willful or knowing violation) available to an injured person under RSA 359-C:21, I.

Rule
Per violation only
As of
2 September 2026
Currency
USD
Per violation unit
Violation
Per violation amount
10,000

Who enforces it

Enforcement body

New Hampshire Attorney General, under RSA 358-A:4 as invoked by RSA 359-C:21, II; a person injured by a violation may also bring a private civil action under RSA 359-C:21, I.

What it reaches

Obligation class

Breach notice

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A person doing business in New Hampshire that owns or licenses computerized data including personal information must, on becoming aware of a security breach, determine the likelihood of misuse and notify affected individuals and the Attorney General's office as soon as possible, with notice to consumer reporting agencies required once more than 1,000 residents are affected. "Personal information" excludes information lawfully made available to the public from government records.

The codified text's own source note dates this subdivision to 2006, 242:1, effective January 1, 2007. Unlike the comprehensive act, this statute arms an injured person with a private right of action, including treble damages for a willful or knowing violation.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach

Read the law

official New Hampshire statute text, RSA chapter 359-C, New Hampshire General Court website

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app