New Hampshire's Breach Law, RSA 359-C:19 to 359-C:21: Notice Whenever Misuse Cannot Be Ruled Out

What RSA 359-C:19 to 359-C:21 Cover

The breach provisions are a short subdivision, headed "Notice of Security Breach," inside RSA chapter 359-C, Right to Privacy. All three sections carry the same source note: "2006, 242:1, eff. Jan. 1, 2007." None lists an amendment, so the text below has stood since the first day it applied.

RSA 359-C:19 defines "person" to include not only businesses but "any agency, authority, board, court, department, division, commission, institution, bureau, or other state governmental entity, or any political subdivision of the state." A "security breach" is unauthorized acquisition of computerized data that compromises personal information "maintained by a person doing business in this state." The subdivision does not reach paper records.

Personal information is a first name or initial and last name with one of three elements: a Social Security number, a driver's license number "or other government identification number," or an account or card number with the code or password that permits access to a financial account. There is no biometric element, no online-credential element and no redaction standard. The exclusion turns on encryption alone. Data is encrypted if transformed so there is "a low probability of assigning meaning without use of a confidential process or key," or otherwise made "completely unreadable or unusable." It loses that status if acquired together with the key, code or password.

The Misuse Determination

RSA 359-C:20, I(a) requires a person who owns or licenses the data, on becoming aware of a breach, to "promptly determine the likelihood that the information has been or will be misused." Three outcomes lead to notice: misuse has occurred, misuse is reasonably likely, or "a determination cannot be made." Only a determination that misuse is not reasonably likely ends the obligation, and an inconclusive assessment does not.

Notice goes to affected individuals "as soon as possible," and paragraph I(b) repeats that disclosure is to be made "as quickly as possible, after the determination." No day limit appears. Paragraph II allows delay if a law enforcement agency, or a national or homeland security agency, determines notice would impede a criminal investigation or "jeopardize national or homeland security."

A person maintaining data it does not own takes a different route. Under paragraph I(c) it must notify and cooperate with the owner "immediately following discovery" if the information was acquired by an unauthorized person. No misuse assessment comes first, and cooperation does not extend to confidential business information or trade secrets.

Notice to the Attorney General or a Primary Regulator

Paragraph I(b) splits the state notice. "Any person engaged in trade or commerce that is subject to RSA 358-A:3, I shall also notify the regulator which has primary regulatory authority over such trade or commerce. All other persons shall notify the New Hampshire attorney general's office." RSA 358-A:3, I is a specific list, not a general regulated-industry exemption. It covers trade subject to the bank commissioner, the director of securities regulation, the insurance commissioner, the public utilities commission, other states' financial institution and insurance regulators, or federal banking or securities regulators with authority over unfair or deceptive practices.

Either notice must state "the anticipated date of the notice to the individuals and the approximate number of individuals in this state who will be notified." The paragraph adds that nothing requires giving the regulator or the Attorney General the individuals' names or personal information. Paragraph V separately deems a 358-A:3, I business compliant if it follows breach procedures issued by its state or federal regulator. No minimum number of affected residents triggers the state notice.

How Individuals Are Told

Paragraph III lists five methods. Written notice is always available. Electronic notice is permitted where it is the business's "primary means of communication" with the individuals. Telephonic notice is permitted "provided that a log of each such notification is kept." Notice under the person's internal procedures in an information security policy is permitted too.

Substitute notice opens at comparatively low figures: cost above $5,000, more than 1,000 affected individuals, or insufficient contact information "or consent." It consists of email where available, a website posting and notice to major statewide media. Under paragraph IV, the notice must contain a general description of the incident, the approximate date of breach, the type of personal information obtained, and "the telephonic contact information of the person subject to this section."

Notice to Consumer Reporting Agencies

Paragraph VI(a) applies when more than 1,000 consumers must be notified. The person must then tell the nationwide consumer reporting agencies defined in 15 U.S.C. § 1681a(p), without unreasonable delay, of "the anticipated date of the notification to the consumers, the approximate number of consumers who will be notified, and the content of the notice." As with the state notice, names and personal information need not be passed on. Paragraph VI(b) removes persons subject to Title V of the Gramm-Leach-Bliley Act from this paragraph only, not from the rest of the section.

Private Action and Attorney General Enforcement

RSA 359-C:21, I lets "any person injured by any violation" sue for damages and equitable relief. Recovery is actual damages; for "a willful or knowing violation" the court "shall award as much as 3 times, but not less than 2 times, such amount," plus costs and reasonable attorney's fees to a prevailing plaintiff. Waivers of the damages right are void, and private plaintiffs may obtain injunctions without bond.

Paragraph II directs the Attorney General's office to enforce the subdivision "pursuant to RSA 358-A:4." That section allows injunctions, restitution and civil penalties "up to $10,000 for each violation." The court counts unlawful acts "without regard to the number of persons affected," and a defendant's good-faith misunderstanding of the requirements is an affirmative defense to penalties. Paragraph III of 359-C:21 places "the burden" on the person responsible for the misuse determination "to demonstrate compliance with this subdivision."

No enforcement action is recorded in this post. The Department of Justice website at doj.nh.gov returned HTTP 403 to every request made for this post on October 26, 2026, by direct fetch and through a fetching tool, so neither its breach notice pages nor its releases could be read. Under this site's rules an unread source cannot be cited, so the enforcement count here is zero because the record could not be reached, not because none exists. The one New Hampshire reference that could be read is a list: the Kentucky Attorney General's July 20, 2026 release on the 23andMe settlement names New Hampshire among the 42 participating states, without citing any state's breach statute.

Frequently Asked Questions