1. Home
  2. State breach laws
  3. New Hampshire

New Hampshire data breach notification law

What New Hampshire requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by N.H. Rev. Stat. Ann. §§ 359-C:19 to 359-C:21 (notification at § 359-C:20).

No fixed deadline
Notification deadline
Required
AG notification
Yes
Private right of action
None
Liability protection

What this means if you sell security services

New Hampshire sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. A private right of action adds lawsuit exposure on top of regulatory cost, which makes incident-readiness, documented controls, and evidence-quality logging an easy conversation.

See recent New Hampshire breach filings →

Requirements in detail

Statute
N.H. Rev. Stat. Ann. §§ 359-C:19 to 359-C:21 (notification at § 359-C:20)
Deadline to notify residents
As soon as possible after the business determines that misuse of the information has occurred or is reasonably likely, or cannot make that determination, with no fixed number of days. Notice may be delayed if a law enforcement or national or homeland security agency determines it would impede an investigation or jeopardize security.
Attorney General notification
Yes, whenever residents must be notified, with no minimum number of residents. Businesses subject to the Consumer Protection Act's regulator exemption notify their primary regulator instead, and all others notify the Attorney General's office. The notice must state the anticipated date of notice to individuals and the approximate number of New Hampshire residents being notified. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 consumers are notified, unless the business is subject to the Gramm-Leach-Bliley Act.
Penalties
Any person injured by a violation can sue for actual damages, and for willful or knowing violations the court must award two to three times actual damages, plus costs and attorney's fees. The Attorney General enforces the law through the Consumer Protection Act, which allows civil penalties of up to $10,000 per violation.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
New Hampshire's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. New Hampshire has no law limiting breach lawsuits for organizations that maintain a security program.

New Hampshire breach notification FAQ

What is the data breach notification deadline in New Hampshire?

As soon as possible after the business determines that misuse of the information has occurred or is reasonably likely, or cannot make that determination, with no fixed number of days. Notice may be delayed if a law enforcement or national or homeland security agency determines it would impede an investigation or jeopardize security. The governing law is N.H. Rev. Stat. Ann. §§ 359-C:19 to 359-C:21 (notification at § 359-C:20).

Does New Hampshire require notifying the Attorney General of a data breach?

Yes, whenever residents must be notified, with no minimum number of residents. Businesses subject to the Consumer Protection Act's regulator exemption notify their primary regulator instead, and all others notify the Attorney General's office. The notice must state the anticipated date of notice to individuals and the approximate number of New Hampshire residents being notified. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 consumers are notified, unless the business is subject to the Gramm-Leach-Bliley Act.

What are the penalties for failing to report a data breach in New Hampshire?

Any person injured by a violation can sue for actual damages, and for willful or knowing violations the court must award two to three times actual damages, plus costs and attorney's fees. The Attorney General enforces the law through the Consumer Protection Act, which allows civil penalties of up to $10,000 per violation.

Can individuals sue over a data breach in New Hampshire?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in New Hampshire?

New Hampshire's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does New Hampshire limit breach lawsuits for companies with a cybersecurity program?

No. New Hampshire has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the New Hampshire Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →