Law / United States / 
New Hampshire
New Hampshire Data Privacy Act (NHDPA), general applicability and controller and processor duties
RSA 507-H:2, 507-H:6, 507-H:7, 507-H:10
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Independent third party
- Where the report goes
- Produced on request
What it requires
- Determine whether you conduct business in New Hampshire, or produce a product or service targeted to New Hampshire residents, and controlled or processed the personal data of at least 35,000 unique consumers, or 10,000 consumers while deriving more than 25 percent of gross revenue from selling personal data, before relying on any NHDPA exemption.
- Limit personal data collection to what is adequate, relevant, and reasonably necessary, and describe your purposes in a privacy notice.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkCM.AW-P1
- Confirm a processor you use acts only on your instructions and assists with rights requests, security, and breach notification.NIST Privacy FrameworkID.DE-P5
These lines are LexLint's reading of the law's text. Also read by: New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P5Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.nh.gov/data-privacy-enforcement
- Guidance body
- New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau
- Open questions
- Does 'Financial institution or data subject to Title V of the Gramm-Leach-Bliley Act' in RSA 507-H:3, I(e) exempt every financial institution as an entity, or only data that Title V governs?
What it makes you log
Who may demand the log
Counterparty
What the log must hold
Decision basis
Logging duty
A processor must supply the information a controller needs to conduct and document its data protection assessments, make available to the controller all information needed to show the processor's compliance, and give the controller a report of any assessment on request. A controller that processes personal data under an exemption bears the burden of demonstrating that the processing qualifies and meets the limits in RSA 507-H:10, VI. None of these can be met without a kept record. The text names no field of the record, sets no retention period and sets no audit schedule. The duty to conduct and document a data protection assessment, and the Attorney General's power to require its production, sit in RSA 507-H:8, which this row does not cite. RSA 507-H:6 (privacy notice, security practices, consent revocation mechanism) states policies and requires no record. The controller's own assessment of the processor is a route the vocabulary has no value for, so only the independent assessor route is coded as the auditor. The territorial hook is taken from RSA 507-H:2, I, with consumer defined in RSA 507-H:1 as an individual who is a resident of the state.
- Kind
- Implicit
- As of
- Provision
- RSA 507-H:7, I(c) and II(c), II(e) (a processor gives the controller what it needs to conduct and document data protection assessments, makes available the information needed to demonstrate the processor's compliance, and reports an assessment on request) and RSA 507-H:10, VII (a controller processing under an exemption bears the burden of demonstrating that the processing qualifies)
- Trigger
- personal_data_processing
What this law does
NHDPA governs private-sector processing of New Hampshire residents' personal data. It applies to a person conducting business in New Hampshire, or producing a product or service targeted to New Hampshire residents, that in a year controlled or processed the personal data of at least 35,000 unique consumers (excluding data processed solely to complete a payment transaction), or 10,000 consumers while deriving more than 25 percent of gross revenue from the sale of personal data.
Controllers must limit collection to what is adequate, relevant, and reasonably necessary and describe their purposes in a privacy notice; processors act only on the controller's instructions and assist with rights requests, security, and breach notification.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .