New Hampshire SaaS Agreement Review
New Hampshire was the first New England state after Connecticut to pass a comprehensive privacy law, and it set a lower bar than most. RSA 507-H, effective January 1, 2025, can reach a Manchester ecommerce shop or a Portsmouth software firm with 35,000 New Hampshire consumers in its systems. There is no state sales tax on SaaS, but the processor contract carries real legal weight.
Consumer privacy law in New Hampshire
New Hampshire Data Privacy Act
Data rights in New Hampshire
New Hampshire has enacted the New Hampshire Data Privacy Act, a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about New Hampshire residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
When does RSA 507-H apply?
The act covers businesses that operate in New Hampshire or target its residents and, in a year, control or process personal data of at least 35,000 unique consumers (excluding payment-only data), or at least 10,000 consumers while earning more than 25% of gross revenue from selling personal data. Enforcement is by the attorney general. A mandatory 60-day cure period ran through 2025; from 2026 the attorney general may offer a chance to cure but no longer has to.
What should the processor terms include?
RSA 507-H requires a binding controller-processor contract covering instructions, purpose, data types, duration and the parties' rights, along with confidentiality, deletion or return at the end of service, compliance information, subcontractor flow-down and assessments. Because the cure period is now discretionary, gaps in a vendor agreement matter more in 2026 than they did when the law began.
Also check whether the vendor uses your data for targeted advertising or sells it. New Hampshire residents have the right to opt out of both, and you need the vendor's help to honor those requests.
Breach notice under RSA 359-C
RSA 359-C:20 requires notice to affected residents as soon as possible, notice to the attorney general (or the business's primary regulator), and notice to consumer reporting agencies when more than 1,000 people are notified.
New Hampshire sources checked 2026-10-09: Lewis Rice, New Hampshire privacy law overview · Davis Wright Tremaine, New Hampshire breach summary. Laws change; confirm the current rule before relying on it.
New Hampshire SaaS agreement FAQ
Does New Hampshire have a data privacy law that affects SaaS contracts?
Yes. New Hampshire has enacted a comprehensive consumer privacy law, the New Hampshire Data Privacy Act. It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about New Hampshire residents.
Can a SaaS vendor use my New Hampshire business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of New Hampshire law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in New Hampshire?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against New Hampshire law in about a minute.
Does New Hampshire tax SaaS subscriptions?
No. New Hampshire has no general sales tax, so a SaaS subscription bought by a New Hampshire business is not subject to state sales tax. If your vendor adds a sales tax line for a New Hampshire address, ask why; it may be applying another state's rules to your billing address by mistake.
Has New Hampshire's privacy-law cure period ended?
The mandatory one has. Through December 31, 2025, the attorney general had to give 60 days to fix a violation before acting. As of 2026 a cure opportunity is at the attorney general's discretion, so vendors and buyers should treat the processor contract as needing to be right from day one.
Reviewing a SaaS contract in New Hampshire?
Upload it and get the data, liability, and renewal terms checked against New Hampshire law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current New Hampshire law when you run your agreement, and you should confirm anything critical with a qualified attorney.