New Hampshire Data Breach Notification Law

The New Hampshire data breach notification law and its misuse test

RSA 359-C:19 to 359-C:21, unchanged since January 1, 2007, asks two things of a business that learns of a breach: a prompt assessment of how likely misuse is, and letters to affected individuals as soon as possible when they are needed ¹.

The test leans toward notice. Notice is required if misuse has occurred or is reasonably likely, and also if the business cannot make a determination ¹. An inconclusive investigation is not a reason to stay silent. The business carries the burden of showing it complied.

The Attorney General filing and the letter's contents

Every breach that requires individual notice must also be reported to the New Hampshire Attorney General's office, with the anticipated date of notice to individuals and the approximate number of New Hampshire residents who will be notified ¹. A business regulated under RSA 358-A:3, I reports to its primary state regulator instead. No deadline is set for this filing, but since it states the planned notice date, prepare it before the letters go out.

New Hampshire is specific about the letter itself. It must include a general description of the incident, the approximate date of the breach, the type of personal information involved and a phone number people can call ¹.

When more than 1,000 consumers are notified, all consumer reporting agencies must be told without unreasonable delay, unless the business is subject to the Gramm-Leach-Bliley Act ¹. A vendor must notify and cooperate with the data owner immediately.

A narrow definition, with a strong encryption rule

Only three identifiers are protected: a Social Security number, a driver's license or other government ID number, or a financial account number with the code to use it ¹. Health records, passwords and biometrics are off the list, but not off the hook: out-of-state residents in the same incident may have broader laws, and patient records sit under HIPAA's 60-calendar-day limit from discovery ², explained in our HIPAA letter rule summary.

Encrypted data is exempt, but not if it was acquired together with any key, security code, access code or password needed to read it ¹. An attacker who took the files and the credentials to open them has taken unencrypted data under this rule.

New Hampshire lets injured people sue

People injured by a violation may sue for damages, with 2 to 3 times damages for willful or knowing violations, plus costs and attorney's fees ³. That private right raises the stakes of a late or incomplete notice. The Attorney General also enforces the law under the Consumer Protection Act ³.

Where a New Hampshire business should start

Still under attack? A covered New Hampshire business starts with its carrier's claim line, alerts the FBI by filing at ic3.gov, and leaves disks unwiped until the evidence is captured ⁴⁵⁶.

Then a response firm or your outside IT help contains it and collects what the misuse assessment needs. Sort people by state: Massachusetts wants its Attorney General and consumer affairs office told whenever residents are, and Maine sets a 30-day deadline; other states' rules are in our table. The controls carriers ask about are listed separately.

RSA 359-C:20 was compared with this page on October 13, 2026. With a private right to sue in play, get legal advice from a New Hampshire lawyer before relying on any reading of it.