New Hampshire. Breach notification. Act
NH breach lawNew Hampshire data breach notification law (N.H. Rev. Stat. §§ 359-C:19 to 359-C:21)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about New Hampshire residents to notify affected individuals after a security breach. Core timing rule: Individuals as soon as possible. Covered data: name plus SSN, driver's licence/government ID, financial account or card numbers with codes.
- Key themes
- Unique features
Private right of action with double to treble damages for wilful violations; AG notices are published online.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: New Hampshire requires the maintaining entity to notify and cooperate with the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals as soon as possible; AG or primary regulator for every notifiable breach; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Actual damages (2x-3x for wilful violations) plus fees; AG enforcement under Consumer Protection Act
§3Dates
- Key dates
- Adopted
- In force
- No amendment identified since enactment
§4Text and authority
- Text
- Authoritative text gc.nh.gov
- Authority
- New Hampshire Department of Justice (Attorney General)
§5Where it applies
- Domestic law of
- New Hampshire
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.