Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | New Hampshire |
|---|---|
| Statute citation | N.H. Rev. Stat. Ann. §§ 359-C:19 to 359-C:21 (New Hampshire Right to Privacy Act (Notice of Security Breach Subdivision)) (amended 2006) |
| Individual notice timing | Not extracted in our PRC 2026 summary; check the statute. |
| Attorney general notice | Yes New Hampshire requires notification to the primary regulatory authority or Attorney General's office |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | In New Hampshire 'security breach' means unauthorized acquisition of computerized data that compromises the security or confidentiality of personal information maintained by a person doing business in this state. Good faith acquisition of personal information by an employee or agent of a person for the purposes of the person's business shall not be considered a security breach, provided that the personal information is not used or subject to further unauthorized disclosure. 1 |