Highlights

Covered Entities: Any individual, business, private or public entity which “compiles or maintains computerized records” that contain personal information.

Consumer Notification: Notification to customers required when personal information was, or is reasonably believed to have been, accessed by an unauthorized person.

Regulatory Notification: To the Division of State Police in advance of disclosure to any NJ resident.

Notification Timeline: In the most expedient time possible and without unreasonable delay while also considering the measures necessary to determine the scope of the breach and restore reasonable integrity of computer systems.

Data Format: Electronic.

Citations: N.J. Stat. Ann. §§ 56:8-161 to 163

More Details

Definitions:

• Breach: Unauthorized access to electronic files, media, or data containing personal information that compromises the security, confidentiality or integrity of personal information that is not encrypted or rendered unreadable or unusable.
• Personal information (PI): A person’s first name or initial and last name linked with any one or more of the following data elements:
  • Social Security number;
  • Driver’s license number or State identification card number;
  • Account number or credit or debit card number along with a password or code permitting access to the person’s financial account;
  • Username, email address, or any other account holder identifying information together with a password or security question permitting access to the person’s online account; or
  • Dissociated data that, if linked, would constitute personal information if the means to link the dissociated data were accessed in connected with access to the dissociated data.
• Medical Information: N/A
• Health Insurance Information: N/A

Safe Harbors:

• Encryption: There is no breach of personal information when that data was secured by encryption or by any other method or technology that renders the personal information unreadable or unusable.
• Good Faith: Good faith acquisition of personal information by an employee or agent of the business for a legitimate business purpose is not a breach of security, provided that the personal information is not used for a purpose unrelated to the business or subject to further unauthorized disclosure.
• Risk of Harm: Notification to consumers not required if misuse of the information is not reasonably possible. Any determination shall be documented in writing and retained for five years.
• Law Enforcement Delay: Notification shall be delayed if a law enforcement agency determines that the notification will impede a criminal or civil investigation and that agency has made a request that the notification be delayed. The notification to consumers shall be made after the law enforcement agency determines that its disclosure will not compromise the investigation and notifies that business or public entity.
• Public Record: Personal information shall not include publicly available information that is lawfully made available to the general public from federal, state or local government records, or widely distributed media.

Direct Notice:

• Timing: In the most expedient time possible and without unreasonable delay” consistent with “any measures to determine the scope of the breach and restore the reasonable integrity of the system.”
• Format: N/A
• Content: N/A
• Method:
  • Written notice
  • Electronic notice
  • Substitute notice

Substitute Notice:

If notification costs exceed $250,000 or more than 500,000 must be notified, or there is not sufficient contact information, substitute notice may be made by satisfying all of the following: (a) Email notice when there is a known email address; (b) Conspicuous posting on the website; and (c) Notification to major Statewide media.

Remediation Services:

For a breach involving a username or password allowing access to an online account, but no other personal information, notification may be made electronically or other form directing the customer to promptly change their password and security question or answer or take other steps to secure the online account and any other account with the same username or email address or password or security question or answer.

Regulatory Notice:

To the Division of State Police in the Department of Law and Public Safety in advance of disclosure to the person. The notice must include any information pertaining to the breach.

Credit Reporting Agencies Notice:

If notification is due to over 1,000 persons, credit reporting agencies must be notified of the “timing, distribution and content of the notices.”

Third-Party Notice:

Any business or public entity that compiles or maintains computerized records containing personal information on behalf of a covered entity must notify the covered entity of any breach of security immediately following discovery if the personal information was, or is reasonably believed to have been, accessed by an unauthorized person. The covered entity must then notify its affected New Jersey customers.

HIPAA:

N/A

Private Action:

Any willful, knowing, or reckless violation of the data breach notification requirement is an unlawful practice and a violation of New Jersey Statutes Title 56, Chapter 8 (N.J.S.A. 56:8-166). In addition to appropriate legal or equitable relief, a court may award a person who suffers an ascertainable financial or property loss resulting from a violation of the statute threefold their actual damages, plus fees and costs.

Associated Regulations:

• New Jersey Information Protection Act (N.J. Stat. Ann. §§ 56:11-53 - 56:11-55)

Information Security (Retail Only)

Highlights

Covered Entities: Any retail establishment that scans a New Jersey-issued driver's license, probationary license, or non-driver photo identification card, or any similar card issued by another state or the District of Columbia for purposes of identification or permitting its holder to operate a motor vehicle.

First Party Security Standard: Retail establishments are not permitted to maintain information scanned for Permitted Purposes paragraphs (1) or (2). Any scanned information for Permitted Purposes paragraphs (3) through (8) retained by a retail establishment pursuant to this statute shall be securely stored. Information collected by scanning a person's identification card shall be limited to the person's name, address, date of birth, the State issuing the identification card, and identification card number. Note that this Act is limited to identification card scanning. Separately, and irrespective of sector, a controller subject to the New Jersey Data Privacy Act (NJDPA) must take reasonable measures to establish, implement, and maintain administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data, and to secure personal data during both storage and use from unauthorized acquisition. The NJDPA took effect January 15, 2025, and its 18-month right-to-cure period expired on July 15, 2026.

Third Party Security Standard: No retail establishment shall sell or disseminate to a third party any information obtained pursuant to this section for any purpose, including marketing, advertising, or promotional activities, except dissemination as permitted by Permitted Purposes paragraphs (3) through (8) of subsection b. of this section; provided, however, that nothing in this subsection shall be construed to prevent an automated return fraud system from issuing a reward coupon to a loyal customer.

Disposal/Destruction Standard: This is not defined.

Data Format: This is not defined.

Data Breach Notification: Any breach of the security of the information shall be promptly reported to the Division of State Police in the Department of Law and Public Safety and any affected person, in accordance with section 12 of P.L.2005, c. 226 (C.56:8-163).

Citations: NJ ST 56:11-53 through 56:11-55. Also NJ ST 56:8-166.4 et seq. (New Jersey Data Privacy Act), in particular § 56:8-166.12.

More Details

Definitions:

• Permitted Purposes: A retail establishment shall scan a person's identification card only for the following purposes:
  
  • To verify the authenticity of the identification card or to verify the identity of the person if the person pays for goods or services with a method other than cash, returns an item, or requests a refund or an exchange;
  • To verify the person's age when providing age-restricted goods or services to the person;
  • To prevent fraud or other criminal activity if the person returns an item or requests a refund or an exchange and the business uses a fraud prevention service company or system;
  • To prevent fraud or other criminal activity related to a credit transaction to open or manage a credit account;
  • To establish or maintain a contractual relationship;
  • To record, retain, or transmit information as required by State or federal law;
  • To transmit information to a consumer reporting agency, financial institution, or debt collector to be used as permitted by the federal “Fair Credit Reporting Act,” 15 U.S.C. s.1681 et seq., “Gramm–Leach–Bliley Act,” 15 U.S.C. s.6801 et seq., and the “Fair Debt Collection Practices Act,” 15 U.S.C. s.1692 et seq.; or
  • To record, retain, or transmit information by a covered entity governed by the medical privacy and security rules pursuant to Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the “Health Insurance Portability and Accountability Act of 1996,” Pub.L.104–191.

Methods of Compliance:

This is not defined.

Exclusions:

This is not defined.

Enforcement/Penalties:

Any person who violates the provisions of this act shall be subject to a civil penalty of $2,500 for a first violation and $5,000 for any subsequent violation. The penalty prescribed in this section shall be collected in a civil action by a summary proceeding pursuant to the “Penalty Enforcement Law of 1999,” P.L.1999, c. 274 (C.2A:58–10 et seq.).

In addition to the penalties described in this section, any person aggrieved by a violation of this act may bring an action in Superior Court to recover damages.

Associated Regulations:

N/A

N.J. Stat. § 56:8-166.4, et seq.

Highlights

Applicability:

The NJDPA applies to individuals or legal entities (including nonprofits) that conduct business in New Jersey or produce products or services targeted to residents of New Jersey and, during a calendar year, either:

• Control or Process[1] the Personal Data of at least 100,000 Consumers, excluding Personal Data processed solely for the purpose of completing a payment transaction; or
• Control or Process the Personal Data of at least 25,000 Consumers and derive revenue, or receive a discount on the price of any goods or services, from the Sale of Personal Data.

Among other exclusions, the NJDPA does not apply to protected health information collected by a covered entity or business associate subject to the privacy, security, and breach notification rules under the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act; a financial institution, data, or affiliate of a financial institution subject to the Gramm-Leach-Bliley Act; an insurance institution; Sale of a Consumer’s Personal Data permitted by the Drivers' Privacy Protection Act; Personal Data Collected, Processed, Sold, or disclosed by a consumer reporting agency as authorized by the Fair Credit Reporting Act; a State agency or political subdivision; or Personal Data collected, Processed, or disclosed, as part of research conducted in accordance with the Federal Policy for the protection of human subjects.

Controller Obligations:

Among other obligations, the NJDPA requires that Controllers:

• Limit the collection of Personal Data to what is adequate, relevant, and reasonably necessary in relation to purposes for which such data is Processed, as disclosed to the Consumer.
• Take reasonable measures to establish, implement, and maintain administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of Personal Data and secure Personal Data during both storage and use from unauthorized acquisition. The data security practices should be appropriate to the volume and nature of the Personal Data at issue;
• Provide a reasonably accessible, clear, and meaningful privacy notice to include: categories of Personal Data the Controller Processes; purpose(s) for Processing Personal Data; categories of third parties to which the Controller may disclose a Consumer’s Personal data; categories of Personal Data the Controller shares with third parties, if any; how Consumers may exercise Consumer rights, including the Controller’s contact information and how a Consumer may appeal a Controller’s decision with regard to the Consumer’s request; the process by which the Controller notifies Consumers of material changes to notifications, along with the effective date of the notice; and an active electronic mail address or other online mechanism the Consumer may use to contact the Controller.
• Provide an effective mechanism for a Consumer to revoke consent under that is at least as easy as the mechanism by which the Consumer’s consent was provided and, upon revocation of such consent, cease to Process the data as soon as practicable, but not later than 15 days after the receipt of such request.
• Not Process Personal Data in violation of the laws of New Jersey and federal laws that prohibit unlawful discrimination against Consumers.
• Conduct and document a data protection assessment of each and any Processing activities that involve Personal Data and may present a heightened risk of harm to a Consumer, including the following:
  • Processing Personal Data for purposes of Targeted Advertising or Profiling, if the Profiling presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, Consumers; financial or physical injury to Consumers; a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of Consumers if the intrusion would be offensive to a reasonable person; or other substantial injury to Consumers;
  • Selling Personal Data; and
  • Processing Sensitive Data.
• Upon request, provide the data protection assessment to the New Jersey Division of Consumer Affairs, Department of Law and Public Safety.
• Respond to a Consumer request within 45 days of receipt. The Controller may extend the response period by 45 additional days where reasonably necessary, considering the complexity and number of the Consumer’s requests, provided the Controller informs the Consumer of the extension within the initial 45-day response period, the reason for the extension, and information for all disclosures of Personal Data that occurred in the prior 12 months.
• In the event a Controller declines take action regarding a Consumer request, inform the Consumer without undue delay, but not later than 45 days after receipt of the request, of the justification for declining to take action and instructions for how the Consumer may appeal the decision.
• In response to a Consumer request, provide information, free of charge, once per Consumer, during any 12-month period. If requests from a Consumer are manifestly unfounded, excessive, or repetitive, the Controller may charge the Consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The Controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.
• If a Controller is unable to authenticate a Consumer request, using commercially reasonably efforts, the Controller is not required to comply and must provide notice to the Consumer that the Controller is unable to authenticate the request to exercise such right or rights until the Consumer provides additional information reasonably necessary to authenticate the request.
• A Controller may deny an opt-out request if the Controller has a good faith, reasonable, and documented belief that such request is fraudulent. The Controller must then send notice to the requester that the Controller believes the request is fraudulent, including relevant reasons, and the Controller therefore will not comply with the request.

Note: [effective 6 months following NJDPA effective date]: A Controller that Processes Personal Data for purposes of Targeted Advertising, or the Sale of Personal Data, must allow Consumers to exercise the right to opt out of such Processing through a user-selected universal opt-out mechanism. The platform, technology, or mechanism must:

• Not unfairly disadvantage another Controller;
• Not use a default setting that opts in a Consumer to the Processing or Sale of Personal Data, unless the Controller determines the Consumer has selected such default setting, and the selection clearly represents the Consumer’s affirmative, freely given, and unambiguous choice to opt in;
• Be Consumer-friendly, clearly described, and easy to use by the average Consumer;
• Be as consistent as possible with any other similar platform, technology, or mechanism required by any federal or state law or regulation; and
• Enable the Controller to accurately determine whether the Consumer is a resident of New Jersey and whether the Consumer has made a legitimate request to opt out of the Processing of Personal Data for the purposes of any Sale of such Consumer’s Personal Data or Targeted Advertising.

Processor Obligations:

Among other obligations, the NJDPA requires Processors to:

• Adhere to the instructions of, and assist the Controller in, complying with obligations, including: taking appropriate technical and organizational measures for the fulfillment of the Controller's obligation to respond to Consumer requests to exercise rights the NJDPA; helping meet the Controller's obligations in relation to the security of processing Personal Data and in relation to notification of a breach of the security of the system; and providing necessary information to the Controller to conduct and document any data protection assessments.
• Ensure that each person Processing Personal Data is subject to a duty of confidentiality with respect to the data.
• Engage a subcontractor pursuant to a written contract that requires the subcontractor to meet the obligations of the Processor with respect to Personal Data.
• Enter into a binding contract with the Controller that sets forth instructions for the Processor, including the type of Personal Data subject to Processing, duration of Processing, and the following requirements: at the discretion of the Controller, the Processor will delete or return all Personal Data to the Controller at the end of services, unless retention of the Personal Data is required by law; and the Processor will make available to the Controller all information necessary to demonstrate compliance with obligations under the NJDPA and allow for, and contribute to, reasonable assessments and inspections.

Consumer Rights:

Under the NJDPA, a Consumer has a right to the following:

• Confirm whether a Controller Processes and/or accesses the Consumer’s Personal Data;
• Correct inaccuracies in the Consumer’s Personal Data;
• Delete the Consumer’s Personal Data;
• Obtain a Copy of the Consumer’s Personal Data held by the Controller in a portable and, to the extent technically feasible, readily usable format; and
• Opt out of the Processing of Personal Data for the purposes of Targeted Advertising; Sale of Persona Data; or Profiling, in furtherance of decisions that produce legal or similarly significant effects concerning the Consumer.

More Details

Definitions:

• Biometric Data: Data generated by automatic or technological processing, measurements, or analysis of an individual’s biological, physical, or behavioral characteristics, including, but not limited to, fingerprint, voiceprint, eye retinas, irises, facial mapping, facial geometry, facial templates, or other unique biological, physical, or behavioral patterns or characteristics that are used or intended to be used, singularly or in combination with each other or with other Personal Data, to identify a specific individual. Biometric Data does not include: a digital or physical photograph; an audio or video recording; or any data generated from a digital or physical photograph, or an audio or video recording, unless such data is generated to identify a specific individual.
• Child: As defined under COPPA.
• Consumer: An identified person who is a resident of New Jersey acting only in an individual or household context. Consumer does not include a person acting in a commercial or employment context.
• Controller: An individual, or legal entity that, alone or jointly with others determines the purpose and means of Processing Personal Data.
• Personal Data: Any information that is linked or reasonably linkable to an identified or identifiable person. Personal Data does not include de-identified data or publicly available information.
• Process or Processing: An operation or set of operations performed, whether by manual or automated means, on Personal Data or on sets of Personal Data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of Personal Data, and also includes the actions of a Controller directing a Processor to Process Personal Data.
• Processor: A person, private entity, public entity, agency, or other entity that Processes Personal Data on behalf of the Controller.
• Profiling: Any form of automated Processing performed on Personal Data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
• Sale: Sharing, disclosing, or transferring of Personal Data for monetary or other valuable consideration by the Controller to a third party. Sale does not include: disclosure of Personal Data to a Processor that Processes Personal Data on the Controller’s behalf; disclosure of Personal Data to a third party for the purposes of providing a product or service requested by the Consumer; disclosure or transfer of Personal Data to an affiliate of the Controller; disclosure of Personal Data that the Consumer intentionally made available to the general public through a mass media channel and did not restrict to a specific audience; or disclosure or transfer of Personal Data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the Controller’s assets.
• Sensitive data:​ Personal Data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, which includes a Consumer’s account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a Consumer’s financial account; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data that may be Processed for the purpose of uniquely identifying an individual; Personal Data collected from a known child; or precise geolocation data.
• Targeted Advertising: Advertisements to a Consumer, based on Personal Data obtained or inferred from the Consumer’s activities over time and across nonaffiliated Internet web sites or online applications to predict such Consumer’s preferences or interests. Targeted Advertising does not include advertisements: based on activities within a Controller’s internet websites or online applications; based on the context of a Consumer’s current search query, visit to an internet website, or online application; or in response to a Consumer’s request for information or feedback. Targeted Advertising also does not apply to the Processing or Personal Data solely to measure or report advertising frequency, performance, or reach.

Penalties:

Until the first day of the 18th month following the effective date (i.e., July 15, 2026), the New Jersey Attorney General may provide a 30-day notice and cure period for violations, prior to commencing an enforcement action.

Private Action:

No

Enforcement Action:

Failure to comply can lead to enforcement actions with penalties of up to $10,000 for an initial violation and $20,000 for each subsequent violation under the New Jersey Consumer Fraud Act.

Associated Regulations & Rulemaking:

Senate Bill (S332/A1971)

The New Jersey Consumer Fraud Act (N.J. Stat. § 56:8-1, et seq.)

Notes on AI Related Regulations:

New Jersey’s AI regulatory landscape includes targeted economic development incentives for AI businesses, the creating of the Artificial Intelligence Task Force to guide policy, and statutes addressing specific AI risks such as deepfakes and automated decision-making. The state’s approach is both sectoral and anticipatory, with ongoing study and policy development through the Artificial Intelligence Task Force.

Effective Date:

January 15, 2025

[1] NJDPA does not define the term “Control” but does define “Process”