Law / United States / 
New Hampshire
New Hampshire Data Privacy Act, Attorney General enforcement
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect NHDPA violations to be enforced exclusively by the New Hampshire Attorney General, never by a private plaintiff.
- Cure a noticed violation within 60 days of an Attorney General notice of violation to avoid a civil penalty of up to $10,000 per violation under New Hampshire's unfair trade practices law.
These lines are LexLint's reading of the law's text. Also read by: New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.nh.gov/data-privacy-enforcement
- Guidance body
- New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau
- Open questions
- Does 'each violation' in RSA 358-A:4, III(b), through which RSA 507-H:11, V reaches a civil penalty of up to $10,000, count each affected consumer, each unanswered request or each unlawful processing activity?
What it makes you log
Logging duty
RSA 507-H:11 gives the Attorney General exclusive enforcement authority, sets a notice of violation and a 60-day cure period, bars a private right of action and makes a violation an unfair or deceptive act under RSA 358-A:2. It imposes no duty to make, keep or produce a record and names no power to demand one. The Attorney General's right to require production of a data protection assessment sits in RSA 507-H:8, III, which this row does not cite. The cited section states no territorial reach, so no hook is taken.
- Kind
- None
- As of
What this law does
The New Hampshire Attorney General has exclusive authority to enforce NHDPA. The Attorney General was required to give a controller a notice of violation and 60 days to cure through , and may do so at its discretion afterward; an uncured violation is treated as an unfair trade practice under RSA 358-A, subject to a civil penalty of up to $10,000 per violation, and the chapter creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .