New Hampshire Data Privacy Act (NHDPA), general applicability and controller and processor duties

RSA 507-H:2, 507-H:6, 507-H:7, 507-H:10

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 January 2025.

A comprehensive regime rule binding private bodies.

As of 27 August 2026.

What it requires

Determine whether you conduct business in New Hampshire, or produce a product or service targeted to New Hampshire residents, and controlled or processed the personal data of at least 35,000 unique consumers, or 10,000 consumers while deriving more than 25 percent of gross revenue from selling personal data, before relying on any NHDPA exemption.
Limit personal data collection to what is adequate, relevant, and reasonably necessary, and describe your purposes in a privacy notice.
Confirm a processor you use acts only on your instructions and assists with rights requests, security, and breach notification.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

NHDPA governs private-sector processing of New Hampshire residents' personal data. It applies to a person conducting business in New Hampshire, or producing a product or service targeted to New Hampshire residents, that in a year controlled or processed the personal data of at least 35,000 unique consumers (excluding data processed solely to complete a payment transaction), or 10,000 consumers while deriving more than 25 percent of gross revenue from the sale of personal data.

Controllers must limit collection to what is adequate, relevant, and reasonably necessary and describe their purposes in a privacy notice; processors act only on the controller's instructions and assist with rights requests, security, and breach notification.

When LexLint raises it

automated_outreach
crawls_web
deploys_chatbot
processes_biometrics
processes_voice
trains_models

Read the law

official New Hampshire statute text, RSA chapter 507-H, New Hampshire General Court website

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app