New privacy and data security laws took effect in Nevada and New Hampshire on January 1, 2010, continuing the trend of state governments acting to strengthen data security laws. The article discusses the key provisions of new privacy and data security laws that took effect recently in both Nevada and New Hampshire. Nevada’s law makes it the first state to mandate compliance with the entire Payment Card Industry Data Security Standard (“PCI DSS”). New Hampshire’s law first sets forth restrictions regarding the use and disclosure of personal health information for marketing or fundraising purposes and then sets forth a disclosure requirement if there is unauthorized use or disclosure of protected health information.