Blog

New Hampshire becomes latest state to pass a comprehensive privacy act in 2024

Following signature from the Governor of New Hampshire, Senate Bill 255 has passed into law; effective January 1, 2025

Alexis Kateifides
Director, Regulatory Intelligence
March 7, 2024

Who does the New Hampshire privacy bill apply to?
What are the key requirements?
Next steps and how you can prepare for SB255

On March 6, 2024, New Hampshire Governor Chris Sununu signed Senate Bill 255 (SB255) into law. SB255 was first introduced to the New Hampshire State Senate on January 19, 2023. A year later, the New Hampshire State Senate passed SB255 for An Act relative to the expectation of privacy on January 18, 2024 and, following the Governor’s signature, the Act will now take effect January 1, 2025.

The Act introduces a range of privacy rights for consumers as well as significant requirements for organizations to comply with including purpose limitation, consent for sensitive data, and data security. Read on for a closer look at the Act and how you can prepare.

Who does the New Hampshire privacy bill apply to?

Like most US state privacy laws, the privacy bill in New Hampshire outlines its scope and related application thresholds.

The bill applies to entities that conduct business in the state of New Hampshire or that produce products or services that are targeted to residents of New Hampshire that during a one-year period:

Controlled or processed the personal data of more than 35,000 unique consumers

Controlled or processed the personal data of more than 10,000 unique consumers, and derived more than 25% of their gross revenue from the sale of personal data

What are the key requirements to watch in the New Hampshire privacy act?

The new privacy act in New Hampshire contains several common requirements for businesses to follow which closely mirror those found in other US state privacy laws. Some of the most important areas for you to consider are outlined below.

Consumer rights

The New Hampshire privacy bill defines a range of consumer rights including:

The right to confirm whether a controller is processing their personal data
The right to access their personal data
The right to correct inaccuracies
The right to delete personal data
The right to obtain a copy of their personal data in a portable and readily usable format
The right to opt-out of the processing for purposes of:

Targeted advertising
The sale of personal data
Profiling

Organizations will be required to respond to rights requests within 45 days, but have the option to extend that timeline an additional 45 days when reasonably necessary. Additionally, when an organization declines to take action on a request, consumers must be informed of the justification and instructions on how to appeal. Requests must be fulfilled free of charge, once per consumer in any 12-month period, but organizations may charge the consumer a reasonable fee where requests are unfounded, excessive, or repetitive.

Consent requirements

The New Hampshire privacy bill defines consent as a “clear affirmative act signifying a consumer's freely given, specific, informed and unambiguous agreement to allow the processing of personal data relating to the consumer.” The bill also states that consent can be given in a variety of ways including in writing, through electronic means, or any unambiguous method.

Consent is a vital component for processing sensitive data, targeted advertising, and the sale of personal data under the New Hampshire bill. Organizations will be required to operate on an opt-in basis and cannot process personal data for these stated purposes without first obtaining the consumer's consent.

Privacy notices

As with many other privacy laws, the New Hampshire bill includes a transparency requirement. Organizations must provide consumers with an accessible, clear, and meaningful privacy notice that includes the following information at a minimum:

The categories of personal data processed
The purpose of processing
How consumers may exercise their consumer rights
The categories of personal data shared with third parties

The categories of third parties
An active email address for contacting the organization

Data protection assessments

Organizations are required to perform data protection assessments for processing activities presents a “heightened risk of harm”. These activities include:

Targeted advertising
The sale of personal data
Profiling
Processing sensitive data

Data protection assessments must balance the benefits of the processing against the potential risks it presents to consumers and organizations will need to consider de-identified data, the expectations of consumers, and the relationship between the consumer and the organization.

To lessen the burden on organizations, the New Hampshire bill states that a single data protection assessment can be performed to address comparable processing operations and where a similar assessment has been performing in line with another applicable law or regulation.

Enforcement and penalties

The bill will be enforced by the New Hampshire attorney general. The bill also allows for a 60-day cure period which will expire on December 31, 2025. Beginning January 1, 2026, the Attorney General may consider the following in determining whether to grant an opportunity to cure a violation:

The number of violations
The size and complexity of the organization
The nature and extent of the processing activities
The substantial likelihood of injury to the public
The safety of persons or property
Whether such alleged violation was likely caused by human or technical error.

A violation of the bill will be considered as an action unlawful under the New Hampshire Statute RSA 358-A:2. There is no privacy right of action.

Next steps and how you can prepare for SB255

New Hampshire has become the latest state this year to enact new legislation, further expanding the diverse patchwork of regulations across the United States. This law is set to be implemented on January 1, 2025, providing businesses with just shy of a year to align with its requirements. Begin maintaining your data procedures in line with the bill’s privacy standards through the OneTrust Privacy & Data Governance Cloud which offers tools for dealing with privacy rights requests, privacy notice management, and more.

Blog

New Hampshire becomes latest state to pass a comprehensive privacy act in 2024

Table of contents

Who does the New Hampshire privacy bill apply to?

What are the key requirements to watch in the New Hampshire privacy act?

Consumer rights

Consent requirements

Privacy notices

Data protection assessments

Enforcement and penalties

Next steps and how you can prepare for SB255

You may also like

Privacy Management

2024 to 2025: Preparing for the next wave of privacy regulations

Prepare for 2025's privacy changes with this recap webinar on 2024's regulations and explore upcoming laws, trends, and compliance strategies.

January 23, 2025

Privacy Management

Staying equipped for compliance: A global recap of emerging privacy laws

November 20, 2024

Consent & Preferences

Mastering US opt-out requirements: A practical guide for marketers

Discover how to manage US opt-out requirements and enhance your marketing efforts with this guide. Download now to simplify compliance and build trust.

October 22, 2024

Privacy Automation

Global regulatory update: Recent privacy developments and compliance trends

Join us for a webinar on the latest updates and emerging trends in global privacy regulations.

September 12, 2024

Privacy Management

Preparing for child data protection laws in the US

Join DataGuidance and a panel of experts as we discuss US privacy laws the protection of minors' data.

August 07, 2024

Privacy Management

The road to 50 states: Rhode Island joins the US privacy landscape with a new law

Rhode Island has become the 20th US State to pass a privacy law. On June 25, 2024, the Governor of Rhode Island transmitted the Data Transparency and Privacy Protection Act (RIDTPPA) without signature allowing the Act to become law. Join the webinar to learn more.

July 16, 2024

Privacy Management

Preparing for the future of privacy in healthcare: Going beyond HIPAA compliance

Join us for a discussion on preparing your organization for healthcare privacy compliance that goes beyond HIPAA.

July 11, 2024

Privacy Management

The road to 50 states: Minnesota and Vermont join the US privacy landscape

In this webinar, OneTrust DataGuidance and expert contributors unpack the MCPA and VDPA, examining the requirements, exceptions, and practical implications of the legislations on the data controllers and processors.

June 17, 2024

Privacy Management

From legislation to operation: How to prepare for the new wave of US Privacy laws

Prepare your organization for the new wave of US privacy laws.

June 06, 2024

Third-Party Risk

TPRM privacy compliance: Questions to ask when working with third parties

Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.

May 31, 2024

Comparing US state privacy law requirements

Download our infographic and compare the many US state privacy law requirements that have been enacted or will soon come into effect.

May 14, 2024

Privacy Management

Federal US privacy bill on the horizon? Exploring the draft APRA & new state privacy legislation

Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.

April 23, 2024

Privacy Management

US state privacy laws timeline

View our timeline to understand the progression of current US state privacy laws and key dates.

April 23, 2024

Privacy Management

Spring into action! Navigating CPRA: Ensuring compliance and protecting privacy

Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.

March 21, 2024

Privacy Management

The road to 50 states: New Jersey and New Hampshire join the US privacy landscape

oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.

February 01, 2024

Privacy Automation

Embedding Privacy by Design through PIA Automation

Join us for a webinar on Embedding Privacy by Design through PIA Automation.

January 11, 2024

Privacy Management

Automating fulfillment of subject rights requests in the US

Learn how Privacy Rights Automation helps to fully automate privacy rights requests.

December 06, 2023

Privacy Management

December's deadline: Ensuring compliance with Utah's privacy regulation