In effect
Limited protection
New Hampshire Data Privacy Act (SB 255)
New Hampshire · RSA 507-H (2024 NH SB 255)
New Hampshire residents can access, correct, delete, and port their personal data, and opt out of targeted advertising, data sales, and profiling used in solely automated decisions. Applies at low thresholds (35,000 residents), so it covers many businesses.
Technical detail
RSA 507-H (SB 255, eff. Jan. 1, 2025); 35,000-consumer or 10,000/25%-revenue thresholds; profiling opt-out for solely automated significant decisions; data protection assessments; AG-only enforcement with 60-day cure (first year).
Who is protected: New Hampshire residents
Who must comply: Controllers/processors meeting thresholds
Key facts
| Jurisdiction | New Hampshire |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2025-01-01 |
| Enacted | 2024-03-06 |
| Citation | RSA 507-H (2024 NH SB 255) |
| Enforced by | New Hampshire Attorney General |
| Private right of action | No — agency enforcement only |
| Penalties | Civil penalties via AG; no private right of action |
| Topics | consumer data privacy · automated decision-making · consumer protection · data retention |
| Last verified | 2026-06-12 |
| Official source | New Hampshire Data Privacy Act — Official DOJ FAQ ↗ |
More AI rules in New Hampshire
- NH Deepfake Law (HB 1432) · In effect
- NH Election Deepfake Law · In effect
- New Hampshire HB 1688 (state-agency AI limits) · In effect
- New Hampshire HB 143 (AI chatbot child-safety) · In effect
Related consumer data privacy rules elsewhere
- TAKE IT DOWN Act · In effect
- FCRA (AI in credit & background checks) · In effect
- COPPA + 2025 Rule (childrens data) · In effect
- TCPA (AI voice calls) · In effect
- DEFIANCE Act (deepfake-porn civil suits) · Proposed / pending
- CCPA/CPRA + ADMT Regulations · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.