Businesses operating in New Hampshire face strict new requirements for digital data destruction, IT asset disposal, and e-waste handling as of 2025. This guide details what the New Hampshire Data Privacy Act (NHDPA) and updated e-waste laws mean for your organization, outlining every compliance obligation for hard drive shredding, secure data wiping, and electronics recycling in the state.

New Hampshire Data Privacy Act: Digital Data Destruction Obligations

The New Hampshire Data Privacy Act (NHDPA, RSA 507-H) took effect January 1, 2025, with broad requirements for digital data security and disposal. This law applies to any business processing personal data of at least 35,000 New Hampshire residents, or 10,000 if data sales exceed 25% of revenue. Exemptions cover nonprofits, government agencies, and federally regulated data (e.g., covered by HIPAA or GLBA).

Key NHDPA requirements impacting end-of-life digital assets:

Deletion Right: Consumers can demand deletion of their personal data. Controllers must securely erase data—retiring equipment is not enough; data must be permanently irretrievable under NIST SP 800-88 guidelines.
Data Minimization & Security: Only collect what is necessary, keep for no longer than needed, and implement “reasonable security measures” for digital systems and end-of-life devices.
Processor Duties: All vendors handling your data must be contractually bound to meet NHDPA security and disposal requirements.
Response Deadlines: Businesses must honor deletion requests within 45 days.
Sensitive Data: Extra consent and rigorous protections are required for sensitive data and biometrics.

Enforcement and penalties:

The Attorney General oversees all enforcement. There is a 60-day right to cure violations until December 31, 2025—after which full penalties apply (up to $10,000 per violation). No private lawsuits are allowed. Review NHDPA overview: NH DOJ Data Privacy Enforcement, RSA 507-H Text.

Sector-specific rules:

Financial Services: Remain subject to GLBA. See FTC Safeguards Rule.
Healthcare: HIPAA-covered data requires specific secure disposal under HHS HIPAA PHI requirements.

2025 E-Waste Bans and IT Asset Disposal in New Hampshire

New Hampshire’s e-waste laws (RSA 149-M, HB 1386) ban disposal of most electronics and all rechargeable batteries in landfills or incinerators. Businesses must ensure proper recycling or certified destruction.

2025 updates:

Lithium-ion Battery Ban: As of July 1, 2025, all Li-ion and other rechargeable batteries from IT assets (laptops, tablets, phones, servers, tools, vehicles, e-bikes) are banned from landfill/incinerator disposal. NHDES Battery Disposal Guide
Electronics Ban: Computers, servers, laptops, monitors, peripherals, printers, TVs, projectors, mobile and wireless phones—all prohibited from landfill or incinerator disposal since 2007/2024.
No Mandatory Recycling: New Hampshire encourages (but does not mandate) e-waste recycling. However, businesses generating hazardous waste must ensure proper management and cannot discard e-waste as trash.
Food and Yard Waste Bans: Not directly related to ITAD, but highlights NH’s broad commitment to landfill diversion.

For a full list of banned items and compliance dates, see NHDES Waste Reduction, Resource Recycling update.

How to Comply: Secure Data and Device Disposition in New Hampshire

To fully comply with NH law, digital data destruction and IT asset disposition require a standards-driven approach:

1. Use NIST SP 800-88-Compliant Media Sanitization

All end-of-life hard drives, SSDs, mobile devices, and backup tapes must be sanitized to the “purge” or “destroy” standard using approved physical and logical methods:

Hard Drive Shredding: Physically destroys drives so data cannot be recovered. Certified hard drive destruction is the gold standard.
Data Wiping: Overwriting HDDs using NIST 800-88 software. Not recommended for SSDs due to wear-leveling.
Degaussing: Approved for magnetic media only, never for SSDs.
SSDs and Flash Storage: Require cross-cut shredding or cryptographic erasure.
Chain of Custody: Use a NAID AAA certified provider (NAID AAA) that tracks serial numbers, secures all transports, and provides certificates of destruction mapping NIST standards.

2. E-Waste & Battery Handling

Coordinate all e-waste recycling via certified processors, complying with R2v3 environmental standards for responsible downstream recycling.
For Li-ion and rechargeable batteries, use local or national take-back programs (e.g., Call2Recycle.org, Staples, Best Buy).

3. Document Data and Device Disposition

Maintain auditable records: documentation should include device serials, destruction methods, date/location, and chain-of-custody evidence.
Records support NHDPA, GLBA, HIPAA, and demonstrate proactive defense in case of breach notification under RSA 359-C:19-21.

Sector-Specific Secure IT Asset Disposition

Financial Institutions:

Must comply with GLBA disposal requirements plus NHDPA for all general consumer data.

Healthcare Providers:

PHI destruction must meet HIPAA Security Rule and NHDPA rules. See HIPAA media disposal FAQ.

Schools, Nonprofits, Government:

Generally exempt from NHDPA, but remain subject to sector-specific federal rules; always follow best practices for device and media destruction.

Why Choose Data Destruction, Inc. for New Hampshire Compliance?

Data Destruction, Inc. is the leader in standards-based IT asset disposition and data destruction. Our NAID AAA certified processes ensure total compliance with New Hampshire’s NHDPA and e-waste rules. We deliver:

Fully auditable, NIST SP 800-88-compliant destruction for all data-bearing devices.
Serialized chain-of-custody records and detailed certificates of destruction.
On-site and off-site hard drive shredding—no device ever leaves your control before destruction.
Secure, certified e-waste recycling down the supply chain.
Service tailored to all sectors: healthcare, financial institutions, large and mid-sized enterprises.

Get expert guidance and compliance support. Contact us or call +1 (866) 850-7977.

Frequently Asked Questions

What does the New Hampshire Data Privacy Act (NHDPA) require for data destruction?

The NHDPA mandates secure and permanent deletion of personal data upon consumer request, using recognized standards such as NIST SP 800-88. Devices must be wiped or physically destroyed before disposal or recycling. Delaying or failing to delete data can result in AG enforcement actions.

Which electronics and batteries are banned from landfills/incinerators in NH as of 2025?

As of July 1, 2025, Li-ion and all rechargeable batteries, along with computers, servers, laptops, monitors, printers, TVs, projectors, and mobile/wireless phones, are banned. See NHDES battery ban information.

Is there a mandatory e-waste recycling law for businesses in NH?

New Hampshire does not have mandatory recycling for all, but bans landfilling or incinerating e-waste and batteries. Businesses generating hazardous waste must use certified e-waste recyclers for all prohibited items. Review NHDES e-waste rules.

How should regulated sectors (healthcare, finance) approach IT asset disposition in NH?

Healthcare and financial sectors must continue to follow strict HIPAA and GLBA guidelines, using only NIST-compliant and NAID AAA certified destruction and documented processes.

Can shredding, degaussing, or wiping be used for all device types?

Physical shredding and certified hard drive destruction are required for SSDs and most drives. Degaussing works for magnetic drives only. Software wiping (using NIST 800-88 standards) is appropriate for HDDs intended for reuse, but not SSDs.

What chain-of-custody records are required for NHDPA and e-waste compliance?

Maintain detailed logs tracking serial numbers, custody transfers, and destruction dates/methods. Always request a NAID AAA certificate of destruction for your compliance file.

What is the penalty for non-compliance with NHDPA or e-waste bans?

Fines go up to $10,000 per violation under NHDPA; e-waste violations may trigger additional state penalties. The 60-day right to cure violations ends December 31, 2025.

How long do I have to respond to a consumer’s deletion request?

The NHDPA requires a response within 45 days.

What certifications should I look for in a data destruction vendor serving New Hampshire?

Choose providers meeting NIST SP 800-88, NAID AAA, and environmental standards like R2v3.

How do I get started with NHDPA and e-waste compliance?

Contact a trusted, standards-based partner like Data Destruction, Inc. for a full assessment, secure destruction plan, and documentation package. Get in touch now or call +1 (866) 850-7977.