Following signature from the Governor of New Hampshire, Senate Bill 255 has passed into law; effective January 1, 2025
Alexis Kateifides
Director, Regulatory Intelligence
March 7, 2024
On March 6, 2024, New Hampshire Governor Chris Sununu signed Senate Bill 255 (SB255) into law. SB255 was first introduced to the New Hampshire State Senate on January 19, 2023. A year later, the New Hampshire State Senate passed SB255 for An Act relative to the expectation of privacy on January 18, 2024 and, following the Governor’s signature, the Act will now take effect January 1, 2025.
The Act introduces a range of privacy rights for consumers as well as significant requirements for organizations to comply with including purpose limitation, consent for sensitive data, and data security. Read on for a closer look at the Act and how you can prepare.
Like most US state privacy laws, the privacy bill in New Hampshire outlines its scope and related application thresholds.
The bill applies to entities that conduct business in the state of New Hampshire or that produce products or services that are targeted to residents of New Hampshire that during a one-year period:
Controlled or processed the personal data of more than 35,000 unique consumers
OR
Controlled or processed the personal data of more than 10,000 unique consumers, and derived more than 25% of their gross revenue from the sale of personal data
The new privacy act in New Hampshire contains several common requirements for businesses to follow which closely mirror those found in other US state privacy laws. Some of the most important areas for you to consider are outlined below.
The New Hampshire privacy bill defines a range of consumer rights including:
The right to confirm whether a controller is processing their personal data
The right to access their personal data
The right to correct inaccuracies
The right to delete personal data
The right to obtain a copy of their personal data in a portable and readily usable format
The right to opt-out of the processing for purposes of:
Targeted advertising
The sale of personal data
Profiling
Organizations will be required to respond to rights requests within 45 days, but have the option to extend that timeline an additional 45 days when reasonably necessary. Additionally, when an organization declines to take action on a request, consumers must be informed of the justification and instructions on how to appeal. Requests must be fulfilled free of charge, once per consumer in any 12-month period, but organizations may charge the consumer a reasonable fee where requests are unfounded, excessive, or repetitive.
The New Hampshire privacy bill defines consent as a “clear affirmative act signifying a consumer's freely given, specific, informed and unambiguous agreement to allow the processing of personal data relating to the consumer.” The bill also states that consent can be given in a variety of ways including in writing, through electronic means, or any unambiguous method.
Consent is a vital component for processing sensitive data, targeted advertising, and the sale of personal data under the New Hampshire bill. Organizations will be required to operate on an opt-in basis and cannot process personal data for these stated purposes without first obtaining the consumer's consent.
As with many other privacy laws, the New Hampshire bill includes a transparency requirement. Organizations must provide consumers with an accessible, clear, and meaningful privacy notice that includes the following information at a minimum:
The categories of personal data processed
The purpose of processing
How consumers may exercise their consumer rights
The categories of personal data shared with third parties
The categories of third parties
An active email address for contacting the organization
Organizations are required to perform data protection assessments for processing activities presents a “heightened risk of harm”. These activities include:
Targeted advertising
The sale of personal data
Profiling
Processing sensitive data
Data protection assessments must balance the benefits of the processing against the potential risks it presents to consumers and organizations will need to consider de-identified data, the expectations of consumers, and the relationship between the consumer and the organization.
To lessen the burden on organizations, the New Hampshire bill states that a single data protection assessment can be performed to address comparable processing operations and where a similar assessment has been performing in line with another applicable law or regulation.
The bill will be enforced by the New Hampshire attorney general. The bill also allows for a 60-day cure period which will expire on December 31, 2025. Beginning January 1, 2026, the Attorney General may consider the following in determining whether to grant an opportunity to cure a violation:
The number of violations
The size and complexity of the organization
The nature and extent of the processing activities
The substantial likelihood of injury to the public
The safety of persons or property
Whether such alleged violation was likely caused by human or technical error.
A violation of the bill will be considered as an action unlawful under the New Hampshire Statute RSA 358-A:2. There is no privacy right of action.
New Hampshire has become the latest state this year to enact new legislation, further expanding the diverse patchwork of regulations across the United States. This law is set to be implemented on January 1, 2025, providing businesses with just shy of a year to align with its requirements. Begin maintaining your data procedures in line with the bill’s privacy standards through the OneTrust Privacy & Data Governance Cloud which offers tools for dealing with privacy rights requests, privacy notice management, and more.
Webinar
Join us for a global regulatory recap, where we will explore the latest privacy regulations and key developments impacting compliance in 2024 and beyond. This webinar will offer a streamlined analysis of newly adopted privacy laws, emerging AI regulations, and the evolving cyber regulations such as the NIS2 Directive.
eBook
Discover how to manage US opt-out requirements and enhance your marketing efforts with this guide. Download now to simplify compliance and build trust.
Webinar
Join us for a webinar on the latest updates and emerging trends in global privacy regulations.
Webinar
Join DataGuidance and a panel of experts as we discuss US privacy laws the protection of minors' data.
Webinar
Rhode Island has become the 20th US State to pass a privacy law. On June 25, 2024, the Governor of Rhode Island transmitted the Data Transparency and Privacy Protection Act (RIDTPPA) without signature allowing the Act to become law. Join the webinar to learn more.
Webinar
Join us for a discussion on preparing your organization for healthcare privacy compliance that goes beyond HIPAA.
Webinar
In this webinar, OneTrust DataGuidance and expert contributors unpack the MCPA and VDPA, examining the requirements, exceptions, and practical implications of the legislations on the data controllers and processors.
Webinar
Prepare your organization for the new wave of US privacy laws.
Checklist
Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.
Infographic
Download our infographic and compare the many US state privacy law requirements that have been enacted or will soon come into effect.
Webinar
Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.
Infographic
View our timeline to understand the progression of current US state privacy laws and key dates.
Webinar
Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.
Webinar
oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.
Webinar
Join us for a webinar on Embedding Privacy by Design through PIA Automation.
Webinar
Learn how Privacy Rights Automation helps to fully automate privacy rights requests.
Webinar
Join us for a webinar as we explore the impending implementation of the Utah Privacy Law, set to take effect on December 31, 2023.
Webinar
We explore the new Oregon and Delaware privacy laws, how they differ from other US privacy laws, and what they mean for your business.
Regulation Book
Download the Utah Consumer Privacy Act law book and have the official UCPA text at your fingertips for when the law takes effect on December 31, 2023.
Blog
Get in-depth analysis on two upcoming US Privacy laws, the Oregon Consumer Privacy Act (OCPA) and the Delaware Personal Data Privacy Act (DPDPA), with OneTrust DataGuidence and a panel of experts.
Resource Kit
Download our EU-US Data Privacy Framework resource kit to better understand the new aggreement for cross-border personal data transfers and how to educate your stakeholders.
Resource Kit
Download our US privacy resource kit designed to access a range of materials to help you understand how the US privacy landscape is evolving.
Webinar
In this free webinar, our privacy experts delve into the new Colorado and Connecticut privacy laws and how they differ from other US state regulations.
Webinar
Join our expert panel where we examine upcoming privacy legislation in Indiana, Montana, Tennessee, and Florida and the key requirements of each law.
Infographic
Adapt to Google's June 2023 CMP requirements with this infographic and confidently engage your audience while staying compliant.
Webinar
Join our live webinar as OneTrust DataGuidence and privacy experts examine new privacy legislation in Indiana, Montana, Tennessee, Florida, and Texas.
eBook
Download this eBook and learn how marketers can apply consent and preference principles to build a relationship with their audience built on trust.
Regulation Book
The Colorado Privacy Act (CPA) comes into force on July 1. Get the law's official text right at your fingertips.
Webinar
The Washington My Health My Data Act was signed into law on April 27, 2023 and will be enacted the following year. Join OneTrust DataGuidance and a team of legal experts and get the knowledge you need for compliance.
Webinar
Join the Privacy experts at OneTrust for an update on the new law and learn key requirements of Iowa’s new privacy law and more.
White Paper
Download our white paper and learn how privacy teams help organizations establish and implement polices that ensure AI applications are responsible and ethical.
Blog
Learn how to navigate the new US privacy law exemptions and see how they compare.
Webinar
Join this interactive webinar to learn how OneTrust Privacy Rights Automation helps you to fully automate privacy rights requests for your organization.
Webinar
OneTrust DataGuidance’s webinar discusses Iowa’s CDPA, its similarities to other US privacy laws, its implications on organizations, and steps for compliance.
Webinar
Biometric laws are emerging, and companies must ensure compliance to avoid hefty fines. Join the OneTrust DataGuidance panel of experts to learn more.
Infographic
Businesses at different stages of privacy maturity will need to approach US privacy compliance in different ways. Download the infographic to learn more.
Webinar
Join this US Privacy Demo Series webinar to see a live demo of the OneTrust privacy risk or data protection assessments (PIA's) automation solution.
Webinar
Learn the steps you can take to boost employee trust in compliance with US Privacy Laws in our US Privacy Masterclass on Employee Rights Fulfilment.
Webinar
Join us in our US Privacy Masterclass as we delve into the evolving US privacy landscape and how you can build a trust-based privacy program in 2023.
Webinar
Join us in our US Privacy Masterclass on Risk and DPIAs to understand the operational components for risk assessments/data protection assessments.
Webinar
Our US Privacy Masterclass on Retention & Minimization will help you understand data policy requirements across US Privacy Laws.
Webinar
Join industry experts at OneTrust & Protiviti for an operational deep dive and interactive Q&A on the upcoming US State laws set to go into effect in 2023.
Checklist
Download this checklist to make sure your organization follows the right steps to implement processes that achieve California Privacy Rights Act compliance.
eBook
Learn about the different opt-out requirements, such as a “Do Not Sell My Personal Information” in the US privacy landscape, and how to comply with them.
eBook
Learn more about the three priorities for managing US privacy requirements, including addressing the most visible aspects of US privacy compliance.
Webinar
Join our experts to understand the operational impact of these newly-expanded US consumer rights and how to automate consumer rights request fulfillment.
Webinar
In this webinar, OneTrust experts discuss requirements for conducting PIAs: why they exist, when you should do them, and what they should include.
Webinar
In this session, legal experts Michelle Schaap and Andy Lee are joined by OneTrust DataGuidance to provide an overview of what the ADPPA entails.
Webinar
Attend our webinar, "Establishing and enforcing retention policies," part of the US Privacy Laws Masterclass Series.
eBook
Download this guide to learn how you can comply with the CCPA's opt-out requirements to get on the right track to CCPA compliance.
White Paper
This guide to California privacy law compliance helps your organization understand the requirements under the CCPA and CPRA.
Webinar
Watch our webinars on the latest privacy laws from Utah and Connecticut and what you need to know to prepare in 2023.
Webinar
Join us for a Q&A on the several US state laws going in effect in 2023.
eBook
Download this eBook and explore the key areas of US state privacy laws and how they compare.
Resource Kit
These resources provide key information on US privacy law through blogs, webinars, and eBooks.
Checklist
Download our six step checklist for US privacy laws and ensure that your company remains compliant in 2023.
Webinar
Join us for an overview of Utah's Consumer Privacy Act (UCPA) and its impact on your organization.
Webinar
Attend our webinar, to better understand privacy laws in the US.
Webinar
Watch our webinar as we discuss privacy impact assessments and how they relate to US privacy laws.
Webinar
Watch our US Privacy Law masterclass to learn about opt-out of sales and share requirements and best practices for approaching compliance.
Webinar
Watch our webinar on US privacy laws and gain insight on effective personal information managment strategies.
Webinar
Join us for an overview of US privacy laws and strategies for dealing with compliance.
Webinar
In the first part of our US Privacy Series, we discuss US privacy laws such as the CPRA and best practices towards compliance.
Infographic
Download our infographic on employee rights under the CPRA to help prepare for the law's expansion in CPRA.
eBook
The Ultimate Guide to CCPA Compliance eBook highlights key compliance areas of the CCPA that you should consider when building a privacy program.
eBook
Download this eBook for an overview of the Virginia Consumer Data Protection Act (CDPA) to understand what it means for organizations.
Webinar
Watch our OneTrust CCPA Masterclass Series and learn how to prepare your organization for CCPA compliance.
Webinar
Join this US Privacy Masterclass series as we delve into the evolving US privacy landscape and how you can build a trust-based privacy program in 2023.
Webinar
Watch the OneTrust US Privacy Masterclass series and gain insight on the major US privacy law and best practices.