What's the Consumer Threshold for New Hampshire's Privacy Act to Apply to a Business?

The New Hampshire Privacy Act (NHPA) applies to any business that conducts business in New Hampshire or targets products and services to New Hampshire residents and, during a calendar year, either controls or processes the personal data of at least 35,000 residents, or controls or processes the data of at least 10,000 residents while deriving more than 25% of gross revenue from selling personal data.

The Two-Threshold Test, Broken Down

New Hampshire's law uses the same dual-threshold structure found in several other state privacy laws passed in 2023 and 2024. A business clears the bar if it meets either one of two independent tests: a pure volume test based on how many residents' data it touches, or a lower volume test paired with a revenue condition tied specifically to data sales. A marketing agency or SaaS platform that doesn't sell personal data as a line of business will almost always be measured against the 35,000-resident threshold alone, since the lower 10,000-resident prong only kicks in alongside the 25% revenue condition.

No General Revenue Floor

Unlike Florida's privacy law, the NHPA doesn't set a minimum company-wide revenue requirement for the law to apply at all. A small business with no meaningful annual revenue can still be covered purely by processing enough residents' data, which means business size alone isn't a safe reason to assume the law doesn't apply.

The Cure Period Has Already Expired

The NHPA took effect January 1, 2025, with a built-in 60-day cure period that let businesses fix a violation before facing enforcement. That cure period expired January 1, 2026, consistent with a sunset date written into the statute. Practically, that means the New Hampshire Attorney General — the law's sole enforcer, since the NHPA carries no private right of action — now has full discretion over whether to offer a chance to cure at all.

Where New Hampshire Fits Among Other States

New Hampshire was part of a wave of states that passed comprehensive privacy laws in 2024, following the first group led by California, Virginia, and Colorado. Its thresholds are comparable to several of those peer states, though the exact resident counts and revenue percentages vary enough state to state that a business operating nationally needs to check each one rather than assuming a single number applies everywhere.

What to Check Right Now

• Resident count: Tally how many unique New Hampshire residents your systems process data for annually, including through ad pixels and CRM records, not just paying customers.
• Revenue mix: If personal data sales are part of your business model, calculate what share of gross revenue that represents.
• Documentation: With the cure period gone, having compliance steps already documented matters more than it did in 2025.

Bottom Line

If your business processes personal data for 35,000 or more New Hampshire residents in a year, the NHPA applies regardless of revenue — check your actual resident counts now that there's no guaranteed cure period to fall back on.

Sources: New Hampshire RSA 507-H (New Hampshire Privacy Act); PrivacyLawMap, "New Hampshire Privacy Act Guide" (last reviewed March 2026, privacylawmap.com); Hinshaw & Culbertson, "Q&A: New Hampshire Becomes the Fourteenth State to Pass a Data Privacy Law" (hinshawlaw.com); Clym, "New Hampshire: 14th US State With a Consumer Privacy Law" (clym.io).