New Hampshire Data Breach Notification Laws: Reporting Rules & Timelines (2026)

New Hampshire requires a business that becomes aware of a security breach to promptly determine the likelihood that the information has been or will be misused, and to notify affected residents as quickly as possible under RSA 359-C:20 if misuse has occurred or is reasonably likely to occur, or if a determination cannot be made. There is no fixed-day deadline. Before individual notice goes out, most businesses must also notify the state's Attorney General, though businesses regulated by New Hampshire's banking, securities, insurance, or utilities regulators notify that regulator instead.

If your business handles personal information belonging to New Hampshire residents, a data breach triggers specific legal obligations under New Hampshire's Notice of Security Breach law. N.H. Rev. Stat. 359-C:19 through 359-C:21 sets out who must notify, what triggers the duty, and how quickly you need to act. New Hampshire enacted its breach notification law in 2006 (2006, 242:1), effective January 1, 2007, as part of the state's Right to Privacy chapter, reflecting the legislature's view that breach notification is fundamentally a privacy protection.

This guide covers the full scope of New Hampshire's breach notification requirements, including what personal information triggers the law, who must be notified, the timeline, penalties, exemptions, and how the state's broader data privacy framework interacts with breach obligations.

Who Must Comply With New Hampshire's Breach Notification Law

New Hampshire's law applies to any person doing business in the state, any person that owns or licenses computerized data that includes personal information, or any person that maintains computerized data containing personal information on behalf of another. This broad scope captures businesses, government entities, and third-party service providers.

When a third party that maintains data on behalf of a data owner discovers a breach, it must notify the data owner immediately. The data owner then carries the primary responsibility to notify affected individuals and, depending on its industry, either the Attorney General or its primary sector regulator.

The statute applies regardless of where the business is physically located. Any business that holds personal information about New Hampshire residents must comply if it does business in the state.

What Qualifies as a Breach

Under N.H. Rev. Stat. 359-C:19, a "security breach" means the unauthorized acquisition of computerized data that compromises the security or confidentiality of personal information maintained by a person doing business in New Hampshire.

Good Faith Exception

A good faith acquisition of personal information by an employee or agent of a person doing business in the state does not constitute a security breach, provided the personal information is not used or subject to further unauthorized disclosure.

Encryption Safe Harbor

New Hampshire provides a safe harbor for encrypted data. The notification requirements do not apply to the unauthorized acquisition of personal information that has been encrypted, as long as the encryption key was not also compromised. If both the encrypted data and the key were acquired by the unauthorized person, notification is required.

Personal Information That Triggers Notification

Under N.H. Rev. Stat. 359-C:19, personal information means an individual's first name or first initial and last name combined with any one or more of the following data elements:

• Social Security number
• Driver's license number or other government identification number
• Account number, credit card number, or debit card number combined with any required security code, access code, or password that would permit access to an individual's financial account

What New Hampshire's Law Does Not Cover

Compared to states that have recently updated their breach notification statutes, New Hampshire's definition of personal information is relatively narrow. The law does not include:

• Biometric data (fingerprints, retina scans, voiceprints)
• Medical or health information
• Health insurance identification numbers
• Passport numbers
• Username or email address combined with passwords
• Taxpayer identification numbers (other than SSNs)

Personal information does not include information that is lawfully made available to the general public from federal, state, or local government records. New Hampshire has no broader exclusion for information drawn from other publicly available sources.

Notification Timeline

New Hampshire requires notification "as quickly as possible" under N.H. Rev. Stat. 359-C:20. This language is more urgent than the "without unreasonable delay" standard used by many states, suggesting the legislature intended a particularly prompt response.

The statute does not set a specific day count. Under RSA 359-C:21, III, the burden is on the person responsible for the misuse determination required by RSA 359-C:20, I to demonstrate compliance with the notification subdivision.

When Delay Is Permitted

Under RSA 359-C:20, II, notification may be delayed only if a law enforcement agency, or a national or homeland security agency, determines that the notification will impede a criminal investigation or jeopardize national or homeland security.

That is the statute's only delay ground. New Hampshire does not grant an entity extra time to determine the scope of the incident, identify affected individuals, or restore the integrity of its systems, although the misuse determination required by RSA 359-C:20, I(a) necessarily precedes notice.

Even when delay is permitted, the entity must still act "as quickly as possible" once the reason for the delay no longer applies.

Who Must Be Notified

New Hampshire Attorney General (or Sector Regulator)

Before individual notifications are sent, most businesses must notify the New Hampshire Attorney General. Businesses regulated by New Hampshire's bank commissioner, director of securities regulation, insurance commissioner, public utilities commission, or the financial-institution and insurance regulators of other states or the federal government (per RSA 358-A:3, I) instead notify their own primary regulator, not the Attorney General.

Under RSA 359-C:20, I(b), that notification needs to include only two things:

• The anticipated date of the notice to affected individuals
• The approximate number of New Hampshire residents who will be notified

The entity is not required to disclose the names of affected individuals or their personal information in this notice.

Affected Individuals

Under RSA 359-C:20, I(a), a business that becomes aware of a security breach must promptly determine the likelihood that the personal information has been or will be misused. Individual notice is required if that determination is that misuse has occurred or is reasonably likely to occur, or if a determination cannot be made. Unauthorized acquisition alone does not automatically trigger notice, but a business that cannot rule out misuse must notify. Under RSA 359-C:20, IV, the notification must include:

• A description of the incident in general terms
• The approximate date of the breach
• The type of personal information involved
• The telephonic contact information of the entity providing notice, meaning a phone number and not merely an email or web address

Listing contact information for the Federal Trade Commission and the New Hampshire Attorney General, or steps to protect against identity theft, is a common best practice, but neither is a statutory requirement of the individual notice.

Consumer Reporting Agencies

When a breach requires notification of more than 1,000 New Hampshire residents, the entity must also notify the nationwide consumer reporting agencies without unreasonable delay. The notification must include the timing, distribution, and content of the notification to individuals.

How to Provide Notification

Under RSA 359-C:20, III, New Hampshire permits the following notification methods:

• Written notice sent by mail to the last known address of the individual
• Electronic notice if the entity's primary means of communication with affected individuals is by electronic means
• Telephone notice, provided that the entity keeps a log of each such notification
• Substitute notice, subject to the thresholds below
• Notice under the entity's internal notification procedures, where those procedures are maintained as part of an information security policy for the treatment of personal information

Substitute Notice

New Hampshire has one of the lowest substitute notice thresholds in the nation. Substitute notice is available when:

• The cost of providing notification would exceed $5,000
• The affected class exceeds 1,000 New Hampshire residents
• The entity does not have sufficient contact information

Compare this to most states where the cost threshold is $250,000 and the affected class threshold is 500,000. New Hampshire's low thresholds make substitute notice available to smaller businesses and smaller breaches.

Substitute notice must include all of the following:

1. Email notification to individuals for whom the entity has an email address
2. Conspicuous posting of the notice on the entity's website
3. Notification to major statewide media outlets

Enforcement and Penalties

New Hampshire's breach notification law is enforced by the Attorney General under the Consumer Protection Act (N.H. Rev. Stat. 358-A). A violation of the breach notification requirements constitutes an unfair or deceptive act or practice.

The Attorney General may seek:

• Injunctive relief to stop ongoing violations
• Civil penalties as provided under the Consumer Protection Act
• Restitution for affected consumers
• Attorney's fees and costs of investigation

New Hampshire also gives individuals a private right of action under RSA 359-C:21. Anyone injured by a breach-notification violation may sue for actual damages. If the violation was willful or knowing, the court must award between 2 and 3 times that amount as the total recovery, not actual damages plus an additional multiple, along with attorney's fees, costs, and injunctive relief.

Exemptions

New Hampshire's statute does not contain a blanket exemption for financial institutions or HIPAA-covered entities. It provides two narrower provisions instead:

• Deemed compliance for regulated entities: Under RSA 359-C:20, V, a business subject to RSA 358-A:3, I (regulated by New Hampshire's bank commissioner, director of securities regulation, insurance commissioner, public utilities commission, or an equivalent state or federal financial or insurance regulator) that follows the security-breach notification procedures required by that regulator's laws, rules, or guidance is deemed to be in compliance with RSA 359-C's notification subdivision.
• GLBA carve-out for credit-agency notice only: Under RSA 359-C:20, VI(b), a business subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., is exempt only from notifying nationwide consumer reporting agencies. It must still notify affected individuals and, where applicable, the Attorney General or its sector regulator.

There is no separate HIPAA exemption in this chapter. A HIPAA-covered entity must still comply with New Hampshire's breach notification law unless it independently qualifies for the deemed-compliance provision above.

How New Hampshire's Privacy Laws Interact With Breach Notification

The New Hampshire Privacy Act, effective January 1, 2025, created a comprehensive consumer privacy framework. However, the Privacy Act does not contain its own breach notification requirements. Businesses subject to the Privacy Act must still follow N.H. Rev. Stat. 359-C:19-21 for breach notification.

The Privacy Act adds relevant data protection obligations:

• Data security requirement: Controllers must implement reasonable administrative, technical, and physical data security practices.
• Data minimization: Controllers must limit data collection to what is adequate, relevant, and reasonably necessary.
• Sensitive data consent: Biometric data, precise geolocation, and other sensitive categories require explicit consumer consent before processing.

Both the Privacy Act and the breach notification statute are enforced by the Attorney General under the Consumer Protection Act.

This article provides general legal information about New Hampshire data privacy laws and breach notification requirements. It is not legal advice, and it does not create an attorney-client relationship. Data breach response involves time-sensitive obligations. Consult a qualified attorney licensed in New Hampshire for guidance specific to your situation.

More New Hampshire Laws

• New Hampshire Deepfake Laws
• New Hampshire Employee Monitoring Laws
• New Hampshire GPS Tracking Laws
• New Hampshire Recording Laws

Frequently Asked Questions

How long does a business have to notify New Hampshire residents of a data breach?

New Hampshire law requires notification 'as quickly as possible,' which is a more urgent standard than the 'without unreasonable delay' language used by many states. There is no specific day deadline. The duty is triggered by a risk determination: the business must promptly assess the likelihood that the information has been or will be misused, and must notify if misuse has occurred, is reasonably likely to occur, or cannot be determined. RSA 359-C:20, II permits delay only where a law enforcement agency, or a national or homeland security agency, determines that notice would impede a criminal investigation or jeopardize national or homeland security.

Does New Hampshire require businesses to notify the Attorney General after a data breach?

Most businesses, yes. Before individual notice goes out, businesses must notify the New Hampshire Attorney General, unless they are regulated by the state's banking, securities, insurance, or utilities regulators, in which case they notify that regulator instead. That notification must include only the anticipated date individual notice will go out and the approximate number of affected New Hampshire residents. Consumer reporting agencies must also be notified when more than 1,000 residents are affected.

What is New Hampshire's substitute notice threshold?

New Hampshire has one of the lowest substitute notice thresholds in the nation. A business may use substitute notice when the cost of standard notification exceeds $5,000, the affected class exceeds 1,000 residents, or the entity lacks sufficient contact information. Most states set these thresholds at $250,000 and 500,000 respectively. Substitute notice requires email, website posting, and major media notification.

Does encryption protect businesses from New Hampshire's breach notification requirements?

Yes, New Hampshire provides an encryption safe harbor. If the compromised personal information was encrypted and the encryption key was not also acquired by the unauthorized person, notification is not required. If both the data and the encryption key were compromised, the full notification obligations apply.

Can individuals sue for a breach notification violation in New Hampshire?

Yes. RSA 359-C:21 gives anyone injured by a breach-notification violation a private right of action for actual damages. If the violation was willful or knowing, the court must award 2 to 3 times that amount as the total recovery, plus attorney's fees, costs, and injunctive relief. The Attorney General can also enforce the statute separately under the Consumer Protection Act.