← All US breach laws·NH

New Hampshire data breach notification law

New Hampshire's data breach notification requirements under N.H. Rev. Stat. §§359-C:19 to 359-C:21. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
N.H. Rev. Stat. §§359-C:19 to 359-C:21
Enforcer
New Hampshire Attorney General
AG notification
Required
Private right of action
Yes — residents can sue

Notification deadlines

Notify affected residents
As quickly as possible without unreasonable delay
Notify the state regulator
Yes — written notice to the NH AG and the Department of Justice
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required if misuse of PI has occurred or is reasonably likely to occur
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under New Hampshire law

First name/initial + last name with SSN, DL/state ID, financial account + access code

Penalties and enforcement

Civil enforcement by AG under RSA 358-A; private right of action for actual damages + attorneys' fees
Enforced by: New Hampshire Attorney General. Official regulator page →

Common pitfalls

⚠ NH AG publishes a public log of every reported breach — reputational exposure is automatic upon filing

Frequently asked questions

How long do I have to notify New Hampshire residents after a data breach?
As quickly as possible without unreasonable delay
Do I have to notify the New Hampshire Attorney General?
Yes — written notice to the NH AG and the Department of Justice
Does New Hampshire require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from New Hampshire's breach notification requirement?
Yes — New Hampshire has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can New Hampshire residents sue me directly for a data breach?
Yes — New Hampshire allows a private right of action. Affected residents may sue for actual damages and, in some cases, statutory damages or attorneys' fees. Class actions are common.
What counts as 'personal information' under New Hampshire law?
First name/initial + last name with SSN, DL/state ID, financial account + access code
What are the penalties for failing to comply with New Hampshire's breach notification law?
Civil enforcement by AG under RSA 358-A; private right of action for actual damages + attorneys' fees

Related state breach laws

Nebraska (NE)
Neb. Rev. Stat. §§87-801 to 87-807
Nevada (NV)
Nev. Rev. Stat. §§603A.010 to 603A.290 + SB 220
New Jersey (NJ)
N.J. Stat. §56:8-163
New Mexico (NM)
N.M. Stat. §§57-12C-1 to 57-12C-12

Pre-empt the New Hampshire breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against New Hampshire's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit