Support Centre

New Hampshire


Law: The Act relative to the expectation of privacy (the Act)

Regulator: New Hampshire Attorney General (AG)

Summary: The Act relative to the expectation of privacy (the Act) was signed into law by the Governor of New Hampshire on March 6, 2024. The Act will enter into force on January 1, 2025. The Act introduces obligations for data controllers and processors, including transparency obligations, such as the requirement to provide privacy notices and data security obligations, as well as a requirement to conduct Data Protection Assessments (DPAs) in specific circumstances. The Act also contains provisions that govern controller and processor relationships as well as data subject rights including the right to confirm whether a controller is processing a consumer's data, and rights of access, deletion, correction, and opt-out of certain processing. Furthermore, the Act provides the AG with enforcement powers but does not provide a private right of action.

Beyond the Act, the New Hampshire Insurance Data Security Law entered into effect on January 1, 2020, and requires insurance companies licensed in New Hampshire to, among other things, implement data security programs and report cybersecurity incidents. There is also NH Rev Stat §332-I:1 (1996 through Reg Sess), which requires healthcare providers and business associates to obtain authorization from individuals before using or disclosing their protected health information ('PHI') for marketing purposes. Furthermore, operators of websites, online platforms, and applications targeting students and their families are obliged to create and maintain reasonable data security procedures to protect certain information about students.


Kentucky's Governor Andy Beshear signed the Act Relating to Consumer Data Privacy as an addition to Kentucky's Consumer Protection Act (under Chapter 367 of the Kentucky Revised Statutes) on April 4, 2024. Kentucky's new privacy law is the 16th state consumer privacy law enacted in the US and the third in 2024. It shares many of the same features as the other comprehensive US state privacy laws. Julia Jacobson and Alexandra Kiosse, from Squire Patton Boggs, compare 2024's first three new consumer privacy laws.

New Hampshire, the Granite State, is the 15th U.S. state to enact a consumer privacy law. The new law is Chapter 507-H:7 of the New Hampshire Revised Statutes titled 'Expectation of Privacy' (the New Hampshire Privacy Law). The law passed by New Hampshire's legislature on January 18, 2024, with some technical corrections enrolled on February 9, 2024, and Governor Chris Sununu signed the new law on March 6, 2024.

The New Hampshire Privacy Law, which is in force on January 1, 2025, follows the now-familiar formula of the other comprehensive U.S. state privacy laws passed during the past five years. Julia Jacobson and Sasha Kiosse, from Squire Patton Boggs, look at the provisions of the law, specifically data subject rights and responding to privacy rights requests.