Law / United States / 
New Hampshire
Notice of Security Breach
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- If you do business in New Hampshire and own or license computerized data that includes personal information, notify affected individuals as soon as possible once you determine that misuse has occurred or is reasonably likely to occur, or if you cannot make that determination; also notify your primary regulator, or the Attorney General's office if you have none, stating the anticipated date of the notice to individuals and the approximate number of individuals in this state who will be notified.
- Notify consumer reporting agencies once notice is required for more than 1,000 residents.
- Expect an injured individual to be able to sue for damages, including treble damages for a willful or knowing violation, unlike New Hampshire's comprehensive privacy act.
These lines are LexLint's reading of the law's text. Also read by: New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
RSA 359-C:12 makes a person who wilfully or knowingly participates in a violation of the chapter, or who induces or attempts to induce one, guilty of a misdemeanor. The section states no fine or term of imprisonment.
Penalty structure
This civil penalty, sought by the Attorney General under RSA 358-A:4 as invoked by RSA 359-C:21, II, is separate from the actual damages (doubled or trebled for a willful or knowing violation) available to an injured person under RSA 359-C:21, I.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
New Hampshire Attorney General, under RSA 358-A:4 as invoked by RSA 359-C:21, II; a person injured by a violation may also bring a private civil action under RSA 359-C:21, I.
Settledness
The Attorney General's page lists 'identifying account number' among the data elements of personal information.
- As of
- Guidance link
- https://www.doj.nh.gov/citizens/consumer-protection-antitrust-bureau/security-breach-notifications
- Guidance body
- New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau
- Open questions
- Does an account number alone make data 'personal information' under RSA 359-C:19, IV(a)(3), as the Attorney General's description of an 'identifying account number' suggests, or must it come with the security code, access code or password that the statute pairs with it?
What it makes you log
Who may demand the log
Court
Logging duty
A person who notifies affected individuals by telephone must keep a log of each such notification, and the person responsible for the determination whether misuse is likely must be able to demonstrate compliance with the subdivision, which cannot be done without a record of the determination and the notices. The log duty bites only on the telephone route, one of five notice methods. The text names no field of the log, sets no retention period and sets no audit schedule. The subdivision otherwise requires a notice to individuals and to the regulator or the Attorney General and keeps no record. The Act reaches a person through the doing-business test and through the notice owed to individuals in this state.
- Kind
- Explicit
- As of
- Provision
- RSA 359-C:20, III(c) (telephonic notice, provided that a log of each such notification is kept) and RSA 359-C:21, III (the person responsible for the determination bears the burden of demonstrating compliance)
- Trigger
- security_incident
What this law does
A person doing business in New Hampshire that owns or licenses computerized data including personal information must, on becoming aware of a security breach, determine the likelihood of misuse and notify affected individuals and the Attorney General's office as soon as possible, with notice to consumer reporting agencies required once more than 1,000 residents are affected. "Personal information" excludes information lawfully made available to the public from government records.
The codified text's own source note dates this subdivision to 2006, 242:1, effective . Unlike the comprehensive act, this statute arms an injured person with a private right of action, including treble damages for a willful or knowing violation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .