Title XXXVII, Insurance

If any provision of this chapter, or the application thereof to any person or circumstance is held invalid, such invalidity shall not affect other provisions or applications of this chapter which can be given effect without the invalid provision or application, and to this end th…

I. This chapter establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, as defined in RSA 420-P:3, IV, and notification to the commissioner. II. This chapter shall not be construed to create or imply a priva…

In this chapter: I. "Authorized individual" means an individual known to and screened by the licensee and determined to be necessary and appropriate to have access to the nonpublic information held by the licensee and its information systems. II. "Commissioner" means the insuranc…

I. Implementation of the program shall be commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in …

I. If the licensee learns that a cybersecurity event has or may have occurred, the licensee or an outside vendor and/or service provider designated to act on behalf of the licensee, shall conduct a prompt investigation. II. During the investigation, the licensee, or an outside ve…

I. Each licensee shall notify the commissioner within 3 business days of a determination that a cybersecurity event has occurred when either of the following criteria has been met: (a) New Hampshire is the licensee's state of domicile, in the case of an insurer, or this state is …

I. The commissioner shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this chapter. This power is in addition to the powers which the commissioner has under RSA 400-A:16 …

I. Any documents, materials, or other information in the control or possession of the department that are furnished by a licensee or an employee or agent thereof acting on behalf of licensee pursuant to RSA 420-P:4, IX, RSA 420-P:6, II(b), (c), (d), (e), (h), (j), and (k), or tha…

I. The following exceptions shall apply to this chapter: (a) A licensee with fewer than 20 employees, including any independent contractors, shall be exempt from RSA 420-P:4. (b) An employee, agent, representative, or designee of a licensee, who is also a licensee, shall be exemp…