New Hampshire DPA

New Hampshire Data Privacy Act - controller obligations, consumer rights.


Short name	NH DPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NH DPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for NH DPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for NH DPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NH-DPA-SEC` Data Security Practices	Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the personal data processed; verifiable integrity of the processing software evidences this (RSA ch. 507-H, controller-duties provision)	Scan
`NH-DPA-MIN` Minimisation Accountability	Personal data collection must be adequate, relevant and limited to what is reasonably necessary; a named processing platform with its components enumerated demonstrates the controller knows what it processes and where (RSA ch. 507-H, controller-duties provision)	Scan
`NH-DPA-PROC` Processor Obligations	Processors operate under binding contracts, assist controllers with security and assessment duties, and bind subcontractors equivalently; named suppliers on third-party components demonstrate this oversight (RSA ch. 507-H, processor provisions)	Scan
`NH-DPA-DPIA` Data Protection Assessment Readiness	Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive data processing; assessments depend on recorded versions of the software performing that processing (RSA ch. 507-H, data protection assessment provisions)	Scan
`NH-DPA-RIGHTS` Consumer Rights Fulfilment	Consumers may access, correct, delete and port personal data and opt out of targeted advertising, sale and profiling, including via universal opt-out signals; the systems holding the data must be unambiguously identifiable to execute these rights (RSA ch. 507-H, consumer-rights provisions)	Scan
`NH-DPA-NOTICE` Privacy Notice Documentation	Controllers must provide a reasonably accessible, clear and meaningful privacy notice; supporting system documentation should carry document identity and a creation timestamp so the notice's claims remain auditable (RSA ch. 507-H, transparency provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`NH-RSA-507-H:3`	Consumer Rights: Access, Correction, Deletion & Portability
`NH-RSA-507-H:4`	Opt-Out of Sale, Targeted Advertising & Profiling
`NH-RSA-507-H:5`	Sensitive Data Consent
`NH-RSA-507-H:7`	Data Protection Assessment
`NH-RSA-507-H:8`	Processor Contracts
`NH-RSA-507-H:2`	Privacy Notice
`NH-RSA-507-H:6`	Consumer Appeals
`NH-RSA-507-H:9`	Universal Opt-Out Mechanism

Policy templates

Written for NH DPA:

New Hampshire DPA State Privacy Notice
New Hampshire DPA Consumer Rights Request Handling Procedure

And 22 from the standard set, adapted to NH DPA.