What does New Hampshire require right now?

Comprehensive consumer privacy law covering controllers processing data of 35,000+ NH residents or 10,000+ with 25%+ revenue from data sale. Grants rights to access, correct, delete, and opt out of sale, targeted advertising, and profiling. Requires data protection assessments and processor contracts. AG enforcement only.

Requires the NH DOE to maintain a publicly available inventory of student data elements, adopt a detailed data security/privacy plan, and give breach notification as soon as practicable; each district (LEA) must adopt a data and privacy governance plan covering software inventory, privacy policies, breach response, and service-provider standards, and publicize FERPA rights. The statute does not reference the NIST Cybersecurity Framework.