Governance, risk & compliance

New Hampshire Expectation of Privacy Act (RSA 507-H) RSA 507-H:1 to 507-H:12 (SB 255, 2024)

The New Hampshire expectation of privacy law, RSA 507-H (SB 255, Chapter 5 of 2024), effective 1 January 2025.

It applies to a person that does business in New Hampshire or targets its residents and handles the data of at least 35,000 unique consumers, or at least 10,000 consumers while earning more than 25% of gross revenue from sale. Nonprofits, higher education, GLBA financial institutions and HIPAA covered entities are outside it.

Consumers can confirm and access, correct, delete, get a copy, and opt out of targeted advertising, sale and profiling for significant decisions, with a 45-day response and a 60-day appeal. Controllers need consent for sensitive data and for targeted advertising or sale involving ages 13 to 15, must honour an opt-out preference signal since 1 January 2025, must honour consent revocation within 15 days, and must assess heightened-risk processing created after 1 July 2024.

The Attorney General alone enforces; the 60-day cure was mandatory during 2025 and is now discretionary. Text was read from a legislative mirror because the official sites were unreachable.

Not verified: (1) The official General Court and Department of Justice sites could not be reached from the tool used; the text was read from a legislative mirror (bills. nhliberty.

org, NHLA) that reproduces the chaptered SB 255 (Chapter 5). Confirm on gencourt.

state. nh.

us. (2) The framework URL is the standard RSA table-of-contents address and could not be opened here.

(3) Secretary of state standards for the privacy notice and the means of requests (507-H:4 and 507-H:6) were not read, and were not seen to be published. (4) The sensitive data definition was not itemized; the penalty amount under RSA 358-A was not read.

General information for compliance work, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses New Hampshire Expectation of Privacy Act (RSA 507-H) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to New Hampshire Expectation of Privacy Act (RSA 507-H) compliance

Most of New Hampshire Expectation of Privacy Act (RSA 507-H) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to New Hampshire Expectation of Privacy Act (RSA 507-H), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against New Hampshire Expectation of Privacy Act (RSA 507-H) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports New Hampshire Expectation of Privacy Act (RSA 507-H) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.