ShareAndGoShareAndGo

Data breach notification

New Hampshire data breach notification law

New Hampshire's Right to Privacy chapter covers security breaches in N.H. Rev. Stat. Ann. §§ 359-C:19 to 359-C:21.

The rule's most important words concern what happens when a business cannot tell whether information was misused.

Misuse, and the cases you cannot call

If the determination is that misuse of the information has occurred or is reasonably likely to occur, or if a determination cannot be made, the person shall notify the affected individuals as soon as possible.

Read that last clause twice. Uncertainty does not excuse notice; an inconclusive review leads to the same outcome as a finding of likely misuse. Only a determination that misuse has not occurred and is not reasonably likely takes an incident out of the duty.

Which data is covered

Personal information means a first name or initial and last name combined with a listed element, when either the name or the data elements are not encrypted. New Hampshire lists these elements:

  • Social Security number.
  • Driver's license number or other government identification number.
  • Account number, credit card number, or debit card number with any required security code, access code, or password that would permit access to a financial account.

Encryption has its own definition: the transformation of data through an algorithmic process into a form with a low probability of assigning meaning without a confidential process or key.

Who else must hear

A business whose trade or commerce has a primary regulator under RSA 358-A:3, I notifies that regulator. All other persons notify the New Hampshire attorney general's office. There is no minimum headcount; regulator or Attorney General notice follows any breach that requires notice to individuals. No separate deadline for that notice appears in the text we checked.

Where ShareAndGo fits

When a review stalls, a record of access is often what is missing.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

The watermark is controlled room by room and starts on. Recipients confirm their email with a six-digit code and need no account, groups open only their own folders, and the chained log exports as CSV for the people working out what happened inside ShareAndGo.

New Hampshire questions

What if we cannot tell whether data was misused?
The section treats that the same as likely misuse: if a determination cannot be made, affected individuals are notified as soon as possible.
Is there a day limit?
The text says as soon as possible, with no number of days.
Does every business tell the Attorney General?
No. Businesses with a primary regulator under RSA 358-A:3, I tell that regulator; everyone else tells the attorney general's office.
How does New Hampshire define encryption?
As an algorithmic transformation leaving a low probability of assigning meaning without a confidential process or key.

Review date

Checked against New Hampshire's published law on November 2, 2026. This is general information, not legal advice.

Also on ShareAndGo

Breach notification laws by state

The full list of breach notification rules.

Compare data rooms

How data rooms compare.

ShareAndGo home

Visit the ShareAndGo home page.