New Hampshire SB 255 was signed in March 2024 and takes effect January 1, 2025.
New Hampshire Privacy & Accessibility Laws
New Hampshire enacted its comprehensive privacy law (SB 255) in March 2024, making it one of the states with comprehensive consumer privacy legislation. The law takes effect January 1, 2025. New Hampshire state agencies must also ensure their digital services are accessible to individuals with disabilities.
→
Privacy Law Status
SB 255 Enacted
→
Accessibility Requirements
State Government Websites
New Hampshire state agencies must ensure websites and digital services are accessible under ADA Title II and state IT policies.
New Hampshire Privacy Act (SB 255)
SB 255 establishes comprehensive privacy rights for New Hampshire consumers and obligations for businesses that process personal data.
Key Dates
- Enacted: March 6, 2024
- Effective Date: January 1, 2025
- Cure Period: 60 days (until December 31, 2025, then at AG discretion)
Who Must Comply?
The New Hampshire Privacy Act applies to entities that conduct business in New Hampshire or target New Hampshire residents AND:
| Threshold | Requirement |
|---|---|
| Data Volume | Control or process personal data of 35,000+ New Hampshire consumers (excluding payment transactions) |
| Revenue + Data | Derive more than 25% of gross revenue from selling personal data AND process data of 10,000+ consumers |
Consumer Rights Under SB 255
| Right | Description |
|---|---|
| Right to Know | Confirm whether personal data is being processed and access that data |
| Right to Correct | Correct inaccuracies in personal data |
| Right to Delete | Delete personal data provided by or obtained about the consumer |
| Right to Portability | Obtain personal data in a portable, readily usable format |
| Right to Opt-Out | Opt out of targeted advertising, sale of personal data, and profiling |
Sensitive Data Categories
SB 255 requires opt-in consent for processing sensitive data, including:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health conditions
- Sexual orientation or sex life
- Citizenship or immigration status
- Genetic or biometric data
- Personal data of known children
- Precise geolocation data
Accessibility Requirements
New Hampshire government agencies must ensure digital accessibility for all residents:
State Government Obligations
- New Hampshire state agencies must comply with ADA Title II for all public-facing digital content
- Department of Information Technology provides accessibility guidance
- State websites must follow WCAG 2.1 Level AA guidelines
- Educational institutions must ensure accessible digital learning materials
- State IT procurement requires vendor accessibility compliance
Private Sector Considerations
- Businesses with physical locations in New Hampshire are subject to ADA Title III
- Website accessibility claims can be brought under federal ADA
- Healthcare providers must ensure accessible patient portals
- Financial institutions must provide accessible online banking services
Enforcement
→
Privacy Enforcement
- New Hampshire Attorney General - Exclusive enforcement authority
- 60-day cure period - Until December 31, 2025
- No private right of action - Only AG can enforce
Contact:
Office of the Attorney General
Consumer Protection Bureau
33 Capitol Street
Concord, NH 03301
(603) 271-3641
→
Accessibility Enforcement
- U.S. Department of Justice - ADA Title II and III enforcement
- NH Commission for Human Rights - State disability discrimination
- Private litigation - Federal ADA claims
Contact:
Disability Rights Center - NH
64 N. Main Street, Suite 2
Concord, NH 03301
(603) 228-0432
SB 255 Penalties
| Violation Type | Maximum Penalty |
|---|---|
| Per violation (after cure period) | $10,000 per violation |
| Consumer Protection Act violation | Additional penalties under NH Consumer Protection Act |
| Injunctive relief | Court may order business practices to cease |
Business Obligations
| Obligation | Description |
|---|---|
| Privacy Notice | Clear notice of data categories, purposes, rights, and third-party sharing |
| Data Minimization | Limit collection to what is reasonably necessary for disclosed purposes |
| Purpose Limitation | Process data only for purposes disclosed to consumers |
| Security | Implement appropriate technical and organizational security measures |
| Sensitive Data Consent | Obtain opt-in consent before processing sensitive personal data |
| Request Response | Respond to consumer requests within 45 days (may extend 45 days) |
| Data Protection Assessments | Conduct assessments for high-risk processing activities |
Consumer Rights
New Hampshire residents have comprehensive privacy rights under SB 255:
- Right to Access: Confirm processing and access personal data
- Right to Correct: Correct inaccurate personal data
- Right to Delete: Request deletion of personal data
- Right to Portability: Receive data in portable format
- Right to Opt-Out: Opt out of targeted advertising, sales, and profiling
- Right to Non-Discrimination: Cannot be penalized for exercising rights
- Right to Appeal: Appeal controller's decision on consumer requests
Important Exemptions
SB 255 exempts government entities, nonprofits, higher education institutions, HIPAA-covered entities, financial institutions under GLBA, and data regulated by FERPA, HIPAA, FCRA, or GLBA.
Related Resources
- US Privacy Laws Overview
- State Privacy Law Comparison
- ADA Title II Requirements
- All State Laws
- Privacy Compliance Guide
- Report a Violation
Need Help with New Hampshire Compliance?
SB 255 is now in effect as of January 1, 2025. Businesses should ensure they meet all compliance requirements. Contact our experts for guidance on privacy policies, consumer request processes, and data protection assessments.