US — New HampshireNew Hampshire Consumer Privacy Bill (NHCPB): Complete Compliance Guide
Overview
The New Hampshire Consumer Privacy Bill, or Senate Bill 255, which was enacted in 2023 and effective from January 1, 2025, establishes robust privacy rights for New Hampshire residents and sets clear guidelines for businesses managing personal data.
Does the New Hampshire Consumer Privacy Bill Apply to Your Business?
The NHCPB applies to businesses that meet at least one of its thresholds. Use this tool to check whether it applies to yours.
New Hampshire Consumer Privacy Bill Scope Checker
Answer two questions to determine whether the NHCPB applies to your organization.
Note: the NHCPB applies based on New Hampshire residents' data, regardless of where your business is located.
New Hampshire Consumer Rights Under the NHCPB
The NHCPB grants eight individual privacy rights to New Hampshire residents. Businesses must respond to authenticated requests within 45 days. A 45-day extension is available with written notice to the consumer.
Request access to the information we have collected about you
45-day response windowCorrect inaccurate or incomplete information we have collected about you
45-day response windowDelete personal information we have collected about you
45-day response windowRequest a copy of personal information we have collected about you
45-day response windowLet us know that you don't want us to process your personal information
45-day response windowRequest that we limit how your personal information being used
45-day response windowRequest that we stop selling your personal information
45-day response windowOpt-out of targeted advertisements so that you no longer receive personalized ads
45-day response windowHow Clym Helps You Comply with the New Hampshire Consumer Privacy Bill
Clym detects browser-based Global Privacy Control signals and automatically applies opt-out status — no extra configuration needed from your dev team.
Configurable consent banner with a clear opt-out for targeted ads and data sales, and a full consent audit log.
Clym's Data Subject Request portal handles every NHCPB request type, with built-in 45-day deadline tracking and escalation alerts.
Clym scans your site and generates your NHCPB-compliant privacy notice, updated automatically when new trackers or data categories are detected.
Regulation Summary
- March 16, 2023: NHDPA introduced in the Senate.
- May 20, 2023: Signed into law.
- January 1, 2025: Law becomes enforceable.
- Applies to businesses operating in New Hampshire or targeting New Hampshire residents.
- Businesses that meet one of the following criteria:
- Process personal data of 100,000 or more New Hampshire residents annually.
- Process personal data of 25,000 or more New Hampshire residents and derive 25% or more of their gross revenue from selling personal data.
- Government entities and nonprofits.
- Data governed by HIPAA, FERPA, and GLBA.
- Personal data used in employee or business-to-business contexts.
- Data Security: Implement administrative, technical, and physical safeguards.
- Transparency: Provide clear and accessible privacy notices.
- Purpose Limitation: Use personal data only for disclosed purposes.
- Non-discrimination: Ensure fair treatment of consumers exercising their rights.
- Opt-Out Mechanism: Provide consumers the ability to opt out of data sales, targeted advertising, and profiling.
- Privacy Notices: Disclose categories of data collected, data usage purposes, and third-party sharing practices.
- Data Access Requests: Respond to consumer requests within 45 days, extendable by an additional 45 days when necessary.
- Sensitive Data: Obtain explicit consent before processing sensitive data, including biometric and precise geolocation data.
- High-Risk Activities: Conduct and document data protection assessments for high-risk processing activities, such as profiling or targeted advertising.
- Access: Confirm and access personal data held by businesses.
- Correction: Request corrections to inaccuracies.
- Deletion: Request deletion of personal data.
- Portability: Obtain data in a portable format.
- Opt-Out: Decline data sales, targeted advertising, and profiling.
- Authority: Enforced exclusively by the New Hampshire Attorney General.
- Cure Period: Until December 31, 2025, businesses have 60 days to correct violations. From January 1, 2026, cure periods are at the Attorney General’s discretion.
- Penalties: A violation of the NHDPA is considered an unlawful act under New Hampshire’s Consumer Protection Act (RSA 358-A:2). Civil penalties may be up to $10,000 per violation.
- Additional Actions: The Attorney General may seek injunctions, restitution, legal costs, and appoint a receiver.Criminal penalties apply for intentional violations.
- No Private Right of Action: Only the Attorney General can enforce violations.