Updated November 2026 · Southern New Hampshire
New Hampshire data breach law for small businesses
New Hampshire data breach law sits in RSA 359-C:19 to 359-C:21: what counts as a breach, when you must notify, who you tell and what happens if you do not. It covers computerized data, so we also show where paper files and the FTC Disposal Rule fit in.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- 99¢ per pound
- Since 2007
- BBB A+ rated
- HIPAA BAA on request
Quick answer
New Hampshire data breach law, RSA 359-C:19 to 359-C:21, applies when computerized personal information (a name plus a Social Security number, a driver’s license or other government ID number, or an account or card number with its access code) is acquired without authorization. If misuse has occurred, is reasonably likely or cannot be ruled out, the business must notify affected residents as soon as possible, notify the Attorney General’s office or its primary regulator, and notify the nationwide consumer reporting agencies when more than 1,000 people need notice. Paper files fall under other rules, such as the FTC Disposal Rule, which is why New Hampshire Document Shredding pairs its shredding services with a Certificate of Destruction on every job.
What New Hampshire data breach law covers
The law is short. It took effect on January 1, 2007, and its three sections fit on two printed pages. Section 359-C:19 defines the terms, 359-C:20 sets the duty to notify, and 359-C:21 covers lawsuits and enforcement. Read the definitions first, because they decide whether you have a legal breach at all.
| Term in RSA 359-C:19 | What the statute says, in short | What it means for a small office |
|---|---|---|
| Person | An individual, corporation, trust, partnership, association, LLC or other entity, plus state agencies and political subdivisions | Sole proprietors, landlords, nonprofits and town offices are all covered |
| Computerized data | Personal information stored in an electronic format | Laptops, servers, cloud accounts, email, phones, USB sticks and old hard drives |
| Personal information | First name or initial and last name, plus a Social Security number, a driver’s license or other government ID number, or an account, credit or debit card number with any code or password needed to access the account | A client list with names and emails alone does not meet this definition. A payroll file with names and SSNs does |
| Encrypted | Data transformed so there is a low probability of assigning meaning without a confidential key, or otherwise made completely unreadable or unusable | Encrypted data is not encrypted for this purpose if the key, code or password was taken with it |
| Security breach | Unauthorized acquisition of computerized data that compromises the security or confidentiality of personal information maintained by a person doing business in this state | An employee who opens a file in good faith for work is not a breach, as long as the data is not misused or disclosed further |
Two words do a lot of work here. “Computerized” means the law is about electronic records. “Acquisition” means someone got the data, not just that a door was left open. The statute also excludes information lawfully made available to the general public from federal, state or local government records.
This page explains the statute as written on gc.nh.gov. It is not legal advice. If you have a breach today, call your attorney and your insurer before you send a single notice, and use this page to understand what they tell you.
When a breach triggers notice under RSA 359-C:20
A breach under the definition is not yet a duty to notify. The statute adds a judgment step. When a business that owns or licenses the data becomes aware of a breach, it must promptly determine the likelihood that the information has been or will be misused.
The bar is lower than many owners expect. Notice is required if misuse has occurred, if it is reasonably likely, or if you cannot determine whether it is. So “we are not sure” counts as a yes. Under RSA 359-C:21, the burden is on the business that made the determination to show it complied, which is a good reason to write down how you reached your answer.
Encryption is the biggest single factor. If a stolen laptop’s drive was encrypted and the key was not on a sticky note in the laptop bag, the data on it does not meet the definition of personal information. That is why your IT person keeps pushing for encryption on every device that leaves the building.
If you own the data
A business that owns or licenses the information makes the misuse determination and sends the notices. That is most small offices: the payroll file, the client files and the customer card data are yours.
If you only hold it for someone else
If you maintain data you do not own, you must notify and cooperate with the owner immediately after you discover that the information was acquired by an unauthorized person. Think payroll providers, IT vendors and bookkeepers who host a client’s files.
What to do in the first days after a breach
The statute tells you what you owe. It does not tell you what order to do things in. The FTC’s Data Breach Response guide for business fills that gap, and its first advice is to move quickly to secure your systems and fix the weakness that caused the breach. Here is how the two fit together for a small New Hampshire office.
- Stop the lossTake affected equipment offline, change passwords and access credentials, and bring in help. The FTC suggests a response team that can include forensics, legal and IT people. For a small office, that is often your IT provider, your attorney and your cyber insurer.
- Preserve what happenedDo not wipe the laptop or delete the phishing email. Keep logs and notes. You will need them to decide whether personal information was acquired and to show later how you made that call.
- Make the misuse determinationWork through the four questions above with your attorney. Was it computerized, was it personal information, was it readable, and is misuse likely or impossible to rule out? Write down the answer and the reasons.
- Talk to law enforcementThe FTC advises notifying law enforcement promptly. Under RSA 359-C:20, II, notice may be delayed if a law enforcement agency, or a national or homeland security agency, determines that it would impede a criminal investigation or jeopardize national or homeland security.
- Notify the stateTell the New Hampshire Attorney General’s office, or your primary regulator if you are in a regulated trade. Include the anticipated date of notice to individuals and the approximate number of New Hampshire residents affected. Names and personal information are not required in this notice.
- Notify people, then the bureausSend individual notices as soon as possible. If more than 1,000 consumers need notice, also tell the nationwide consumer reporting agencies, without unreasonable delay, the timing, number and content of the notices.
Customers who receive your letter will start their own recovery. Our guide on what to do after identity theft walks a New Hampshire resident through credit freezes and IdentityTheft.gov, and it is a fair page to point them to.
What the notice must say and how to send it
The statute sets a minimum. A notice to affected residents must include a general description of the incident, the approximate date of the breach, the type of personal information obtained, and your telephone contact information. Add what you are doing about it and what the reader can do, because a short, honest letter keeps the phones calmer.
| Method under RSA 359-C:20, III | When you can use it |
|---|---|
| Written notice | Always |
| Electronic notice | When electronic communication is your primary way of communicating with the person |
| Telephone notice | When you keep a log of each call |
| Substitute notice: email where you have addresses, a conspicuous posting on your website, and notice to major statewide media | When notice would cost more than $5,000, more than 1,000 people must be notified, or you lack enough contact information or consent |
| Your own notification procedures | When they are kept as part of your information security policy for personal information |
Regulated businesses get a shortcut. A person in trade or commerce subject to RSA 358-A:3, I, which has breach procedures under the rules of its state or federal regulator, is deemed to comply if it follows those procedures. The 1,000-consumer credit bureau notice also does not apply to businesses subject to Title V of the Gramm-Leach-Bliley Act. If you are a bank or an insurer, your regulator’s rules come first.
Penalties and who enforces New Hampshire data breach law
Enforcement runs on two tracks. The state can act, and so can the people whose data was lost. Both rest on RSA 359-C:21, and both are a reason to treat the notice duty as a real deadline rather than a courtesy.
The Attorney General
The New Hampshire Attorney General’s office enforces the subdivision under RSA 358-A:4. Its Consumer Protection and Antitrust Bureau handles consumer matters for the state.
Private lawsuits
Any person injured by a violation may sue for damages and for equitable relief, including an injunction. Recovery is actual damages, plus costs and reasonable attorney’s fees for a plaintiff who wins. A waiver of these rights signed in advance is void.
Willful or knowing
If the court finds the violation was willful or knowing, it must award at least 2 and as much as 3 times the actual damages. Sitting on a known breach to avoid bad press is the kind of conduct that invites that finding.
The burden-of-proof rule is the quiet one. Because the business that made the misuse determination has to demonstrate compliance, a written record of your assessment, the dates you learned things and the dates you sent notices is your defense. Put it in the same folder as your records destruction policy and your incident notes.
Most cases that make the news are electronic. For paper, the enforcement stories come from federal agencies, and our post on improper document disposal fines covers HHS and FTC enforcement actions over records that were thrown out instead of destroyed.
Where paper fits: computerized data vs paper files
Here is the part most summaries skip. RSA 359-C:19 defines a security breach as the unauthorized acquisition of computerized data. A box of paper payroll records that falls off a truck is a serious problem, but on the plain text of the statute it is not a security breach under this subdivision. Ask your attorney before you rely on that, because other laws do reach paper.
The FTC Disposal Rule, 16 CFR Part 682, applies to anyone who maintains or possesses consumer information for a business purpose. Employers who run background checks, landlords who pull credit reports, auto dealers and lenders all qualify. Disposal must involve reasonable measures, and the FTC’s example for paper is to burn, pulverize or shred it so the information cannot practicably be read or reconstructed.
Health care is stricter still. Under HIPAA, a breach is defined in 45 CFR 164.402 in terms of protected health information generally, not only electronic records. Financial institutions, including tax preparers, also answer to the FTC Safeguards Rule, 16 CFR Part 314.
The practical answer is the same for both kinds of record. The breach law rewards you for holding less readable data, and the disposal rules tell you how to get rid of paper. When printouts, old client files and expired payroll records are shredded on a schedule, there is less for a thief to take and less for you to explain. Our post on the FACTA disposal rule covers who it reaches in New Hampshire.
For most offices within reach of the state line, drop-off is the cheapest way to clear a backlog. Ten banker’s boxes cost $234.90 at the Tewksbury counter, and twenty cost $434.90. If you would rather not move the boxes, off-site shredding uses the same shredding rates plus a zone fee of $129.95, $159.95 or $199.95, and the paper is shredded at our Tewksbury office after pickup. Full prices are on our shredding rates page.
Shrink what a breach can expose
You cannot make a breach impossible. You can make it smaller, and a smaller breach is cheaper to notify, easier to defend and less likely to cross the 1,000-person line. Four habits do most of the work for a small office.
Collect less
Do you need a full Social Security number on that intake form, or would the last four digits do? Every field you stop collecting is one that cannot be lost.
Encrypt devices
Encrypted data whose key was not taken falls outside the definition of personal information. Turn on full-disk encryption on laptops and phones, and keep keys away from devices.
Keep it shorter
Write a retention schedule and follow it. Payroll and tax records have set periods, and everything past its date is risk with no upside. Destroy on a calendar, not when the closet is full.
Destroy it properly
Shred paper so it cannot be reconstructed and physically destroy old drives. Our hard drive destruction service is quoted per item.
Keep proof of each step. A certificate of destruction shows when records left your control and how they were destroyed. If a former client asks years later what happened to their file, the certificate and your retention log answer in one email. Our post on chain of custody shredding covers the questions to ask any vendor before you hand over boxes.
Frequently asked questions
What is the New Hampshire data breach law?
It is the notice of security breach subdivision of RSA chapter 359-C, sections 359-C:19 to 359-C:21, in effect since January 1, 2007. It defines personal information and a security breach, requires notice to affected residents and to the Attorney General or a primary regulator when misuse is likely or cannot be ruled out, and allows private lawsuits and state enforcement.
Does the New Hampshire breach law cover paper records?
On its text, no. RSA 359-C:19 defines a security breach as unauthorized acquisition of computerized data, meaning personal information stored in an electronic format. Paper is still covered by other rules, including the FTC Disposal Rule for consumer report information, HIPAA for health records and the FTC Safeguards Rule for financial institutions. Ask your attorney before treating a paper loss as no problem.
How fast must a New Hampshire business send breach notices?
The statute says as soon as possible after the business determines misuse occurred, is reasonably likely or cannot be determined. There is no fixed number of days in RSA 359-C:20. Notice may be delayed only if a law enforcement agency, or a national or homeland security agency, determines notice would impede a criminal investigation or jeopardize national or homeland security.
Do we have to tell the New Hampshire Attorney General?
Most businesses do. A business in trade or commerce subject to RSA 358-A:3, I notifies its primary regulator instead, and everyone else notifies the Attorney General’s office. The state notice gives the anticipated date of the individual notices and the approximate number of New Hampshire residents affected. It does not need names or personal information.
When do we have to notify the credit bureaus?
When more than 1,000 consumers must be notified, RSA 359-C:20, VI requires notice, without unreasonable delay, to all nationwide consumer reporting agencies of the anticipated date of the notices, the approximate number of consumers and the content of the notice. Businesses subject to Title V of the Gramm-Leach-Bliley Act are exempt from this paragraph.
Is a stolen encrypted laptop a breach in New Hampshire?
Usually not under this statute, as long as the key, code or password was not taken with it. Personal information is defined as a name plus certain data elements when either the name or the data elements are not encrypted, and data does not count as encrypted if it is acquired with the key needed to read it. Document the encryption and how you know the key was safe.
What are the penalties for violating the New Hampshire breach law?
Any injured person may sue for actual damages, an injunction, costs and reasonable attorney’s fees. If the violation was willful or knowing, the court must award at least 2 and as much as 3 times the actual damages. The Attorney General’s office enforces the law under RSA 358-A:4, and the business that made the misuse determination carries the burden of showing it complied.
How does shredding help with breach risk?
Shredding shrinks what can be lost. Old payroll files, client records and printouts past their retention period carry names, Social Security numbers and account numbers. Destroying them on a schedule, with a Certificate of Destruction for each job, reduces exposure and gives you a record. At our Tewksbury drop-off it costs 99 cents a pound plus $34.90 per job.
Sources
- New Hampshire RSA 359-C:19, Notice of security breach: definitions (NH General Court) (checked November 2026)
- New Hampshire RSA 359-C:20, Notice of security breach required (NH General Court) (checked November 2026)
- New Hampshire RSA 359-C:21, Violation and enforcement (NH General Court) (checked November 2026)
- FTC, Data Breach Response: A Guide for Business (checked November 2026)
- FTC, Disposing of Consumer Report Information? Rule Tells How (checked November 2026)
Shred what a breach could expose
Bring expired client files, payroll records and printouts to Tewksbury on any weekday, or book a pickup from your New Hampshire office. Every job ends with cross-cut shredding at our office and a Certificate of Destruction for your incident and retention files.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound with a $100 minimum.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.