Law / United States / 
New Hampshire
New Hampshire Data Privacy Act, data protection assessments
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to a New Hampshire consumer, including targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, and the processing of sensitive data (RSA 507-H:8, I).
- In each assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (RSA 507-H:8, II).
- Make a data protection assessment available to the attorney general when the attorney general requires its disclosure for an investigation (RSA 507-H:8, III).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer (507-H:8, I), weighing the benefits of the processing against the risks as safeguards mitigate them (507-H:8, II). The attorney general may require a controller to disclose any assessment relevant to an investigation, and the controller must make it available; the attorney general may evaluate it for compliance with the chapter, and assessments are confidential and exempt under RSA 91-A (507-H:8, III). The section sets no period for keeping an assessment. The section has no scope clause; the reach is in 507-H:2, which the duties row cites and this row does not, so no hook is taken.
- Kind
- Explicit
- As of
- Provision
- RSA 507-H:8, I to III (documented data protection assessments)
- Trigger
- personal_data_processing
What this law does
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, some profiling and the processing of sensitive data. The attorney general may require a controller to disclose any data protection assessment that is relevant to an investigation, and the controller must make it available to the attorney general.
Data protection assessments are confidential and exempt from disclosure under RSA 91-A. The assessment requirements apply to processing activities created or generated after , and are not retroactive. The section took effect on .
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web, deploys a chatbot, processes biometric data, processes voice recordings, trains models or makes high-risk automated decisions.