Data Breach Notice to Residents and State Authorities in New Hampshire

At a glance

Requirements one by one

Covered data and the misuse decision

RSA 359-C:19 covers computerized data and requires unauthorized acquisition, rather than access alone. Covered information pairs a person's name or initial and surname with a Social Security number, government ID, or a financial account number plus the access credential needed to enter the account. Data does not count as encrypted when the required key or code is acquired with it.

Under RSA 359-C:20(I)(a), the owner or licensee must assess misuse promptly when it becomes aware of a breach. If it cannot determine whether misuse occurred or is likely, it must still notify affected individuals. A nonowner holder has a different clock: it must tell and cooperate with the owner or licensee immediately following discovery when an unauthorized person acquired the information (§ 359-C:20(I)(c)).

Individual and authority notices

Individual notice is due as soon as possible after the misuse determination; RSA 359-C:20(I)(b) also calls for disclosure as quickly as possible. The statute gives no fixed outer number of days. It does not state a minimum affected-person count for the regulator route. Instead, a person subject to RSA 358-A:3(I) notifies its primary regulator, while all other persons notify the New Hampshire attorney general. That notice states the anticipated individual-notice date and approximate number of New Hampshire individuals to be told (§ 359-C:20(I)(b)).

If more than 1,000 consumers must receive notice, RSA 359-C:20(VI) separately requires notice to all nationwide consumer-reporting agencies without unreasonable delay. The report gives the anticipated date, approximate count, and content of consumer notice. An entity subject to Title V of the Gramm-Leach-Bliley Act is excepted from this credit-bureau route.

Delivery and content

RSA 359-C:20(III)-(IV) allows written notice, electronic notice when electronic communication is the entity's primary method, or telephone notice with a log of each call. The notice must describe the incident, approximate breach date, type of information obtained, and a telephone contact.

The same section permits substitute notice when direct notice would exceed $5,000, the affected class exceeds 1,000, or contact information or consent is insufficient. The substitute combines email where addresses exist, a conspicuous posting on the business website if it has one, and major statewide media (§ 359-C:20(III)(d)).

What trips people up

Different 1,000-person rules. The substitute method is available when the affected class exceeds 1,000, while nationwide consumer-reporting-agency notice applies when the person is required to notify more than 1,000 consumers. The latter has the Title V exception (§ 359-C:20(III)(d), (VI)).

Delay and policy routes have conditions. A law-enforcement, national-security, or homeland-security agency must determine that notice would impede an investigation or jeopardize security before delay is allowed (§ 359-C:20(II)). Internal information-security-policy procedures are an allowed notice method under subsection (III)(e). A regulator-governed trade or commerce entity is deemed compliant under subsection (V) only when it follows applicable regulator breach-notification procedures.

Common questions

Does the statute require a report of every suspected access?

RSA 359-C:19(V) defines a breach by unauthorized acquisition of computerized covered information. The owner then makes the prompt misuse assessment under § 359-C:20(I)(a).

Must the authority receive a list of affected names?

No. RSA 359-C:20(I)(b) expressly says the regulator or attorney general need not receive names or other personal information about those entitled to individual notice.

May the data holder keep its confidential business information from the owner?

RSA 359-C:20(I)(c) requires cooperation and relevant breach information, but expressly excludes a duty to disclose confidential or business information or trade secrets.

Statutes and sources

• N.H. Rev. Stat. § 359-C:19 — data, personal information, and breach definitions.
• N.H. Rev. Stat. § 359-C:20 — notices, delivery, alternatives, and delay.

Current official New Hampshire statutes checked October 14, 2026.