New Hampshire Data Privacy Act 507-H:10-VI: RSA 507-H:10, VI and VII Processing under an exemption must be necessary, proportionate, limited and secured; the controller bears the burden

Processing under the chapter's exemptions (legal compliance, investigations, legal claims, contracts, security and fraud, research, internal operations and others in 507-H:10) must be reasonably necessary and proportionate, adequate, relevant and limited to the specific purpose, and protected by reasonable administrative, technical and physical measures; a controller relying on an exemption must demonstrate that the processing qualifies and meets these conditions.