Processes personal data, in New Jersey

Discrimination in life and health insurance, genetic information, N.J. Stat. § 17B:30-12(e) and (f) · Read the law's page

• Do not discriminate against an individual on the basis of genetic information, or the refusal to submit to a genetic test or make available its results, in issuing, withholding, extending or renewing hospital confinement or other supplemental limited benefit insurance, or in fixing its rates, terms or conditions (N.J.S.17B:30-12(e)).
• Do not make or permit unfair discrimination against an individual in applying the results of a genetic test or genetic information in issuing, withholding, extending or renewing life insurance (including credit life), an annuity, a disability income insurance contract or credit accident insurance coverage (N.J.S.17B:30-12(f)).
• If you will use the results of a genetic test in those lines, notify the individual that the test will be required and obtain the individual's written informed consent before the test is administered, in accordance with P.L.1985, c.179 (N.J.S.17B:30-12(f)).
• Provide that the physician or other health care professional the individual designates promptly receives a copy of the test results and, if required, a qualified professional's interpretation, and that the individual states in writing whether the individual elects to be informed of the results (N.J.S.17B:30-12(f)).

Genetic Privacy Act, N.J. Stat. §§ 10:5-43 to 10:5-49 · Read the law's page

• Do not obtain genetic information from an individual, or from an individual's DNA sample, without first obtaining informed consent from the individual or the individual's representative, unless an exception in section 6(a) applies (N.J.S.A. 10:5-45).
• Do not retain an individual's genetic information without first obtaining authorization under the informed consent requirement, unless retention falls within one of the exceptions in section 7(a) (N.J.S.A. 10:5-46(a)).
• Destroy a DNA sample promptly on the specific request of the individual or the individual's representative, unless retention is necessary for a criminal or death investigation or a criminal or juvenile proceeding, or is authorized by court order (N.J.S.A. 10:5-46(b)).
• Destroy a research subject's DNA sample promptly on completion of the project or the subject's withdrawal, whichever occurs first, unless the individual or the individual's representative directs otherwise by informed consent (N.J.S.A. 10:5-46(c)).
• Destroy a DNA sample taken for insurance or employment purposes promptly after the purpose for which it was obtained has been accomplished, unless a court of competent jurisdiction orders retention (N.J.S.A. 10:5-46(d)).
• On request, let the individual or the individual's representative inspect, request correction of and obtain genetic information from the individual's records, unless the individual directs otherwise by informed consent; for a policy of life insurance or a disability income insurance contract, P.L.1985, c.179 applies instead (N.J.S.A. 10:5-46(e)).
• Do not disclose the identity of an individual on whom a genetic test has been performed, or genetic information about the individual in a manner that permits identification, and do not disclose it in response to a subpoena or other compulsion, unless one of the conditions in section 8(a) is met, including the tested individual's signed consent (N.J.S.A. 10:5-47).
• If you require or request genetic testing or receive records, results or findings of genetic testing, give the person tested notice that the test was performed and the results received, and that the information may not be disclosed without the person's written consent except under the exceptions in section 8, unless the person has directed otherwise by informed consent (N.J.S.A. 10:5-48(a)).

Identity Theft Prevention Act, Social Security number limits, N.J. Stat. §§ 56:8-164 and 56:8-166 · Read the law's page

• Do not publicly post or publicly display an individual's Social Security number, or any four or more consecutive numbers taken from it (N.J.S.A. 56:8-164(a)(1)).
• Do not print an individual's Social Security number on materials mailed to the individual unless State or federal law requires the number on the document, and do not print it on a card the individual needs to access products or services you provide (N.J.S.A. 56:8-164(a)(2)-(3)).
• When a Social Security number is permitted in a mailed application or form, do not print it, in whole or in part, on a postcard or other mailer that needs no envelope, and do not let it be visible on the envelope or without opening the envelope (N.J.S.A. 56:8-164(d)).
• Do not intentionally communicate or otherwise make available to the general public an individual's Social Security number (N.J.S.A. 56:8-164(a)(4)).
• Do not require an individual to transmit his Social Security number over the Internet unless the connection is secure or the number is encrypted (N.J.S.A. 56:8-164(a)(5)).
• Do not require an individual to use his Social Security number to access an Internet web site unless a password, unique personal identification number or other authentication device is also required (N.J.S.A. 56:8-164(a)(6)).

N.J. Stat. Ann. § 56:8-162 (L. 2005, c.226, s.11) · Read the law's page

• This binds any business or public entity holding a customer's records containing personal information within its custody or control, whether or not the entity is otherwise subject to the New Jersey Data Privacy Act.
• Destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable, undecipherable, or non-reconstructable through generally available means.
• A willful, knowing, or reckless violation is deemed an unlawful practice under the Consumer Fraud Act, enforceable by the Attorney General and, separately, by an affected consumer through the Consumer Fraud Act's private right of action for an ascertainable loss.

N.J. Stat. § 56:8-163 · Read the law's page

• Report a breach of security involving computerized personal records to the New Jersey Division of State Police before notifying the affected customer.
• Disclose the breach to each affected New Jersey resident in the most expedient time possible and without unreasonable delay. New Jersey sets no fixed numeric-day cap.

Daniel's Law, P.L.2020, c.125, as amended by P.L.2023, c.113, N.J. Stat. § 56:8-166.1 · Read the law's page

• Within 10 business days after you receive written notice from an authorized person, stop disclosing or re-disclosing on the Internet, or otherwise making available, the home address or unpublished home telephone number of a covered person (N.J.S.A. 56:8-166.1(a)(1) and (2)).
• A covered person is an active, formerly active or retired judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency or prosecutor, and any immediate family member residing in the same household (N.J.S.A. 56:8-166.1(d)).
• Treat making information available or viewable within a searchable list or database as disclosure, whether or not anyone runs a search of it (N.J.S.A. 56:8-166.1(d)).

N.J. Stat. §§ 56:8-166.4 to 56:8-166.19 · Read the law's page

• Limit your collection of a New Jersey resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose disclosed to the consumer.
• Determine whether NJDPA's applicability thresholds and sector exemptions reach your business before assuming coverage or exemption either way.
• Check the section 10 exemptions before treating NJDPA as binding you: it does not apply to HIPAA protected health information or information treated like it, to financial institutions under Gramm-Leach-Bliley, insurance institutions and insurance-support organizations, consumer reporting agencies under the Fair Credit Reporting Act, State and local government bodies, human subjects research, or a national securities association.

N.J. Stat. §§ 56:8-166.4 to 56:8-166.19 · Read the law's page

• Expect NJDPA violations to be enforced exclusively by the Division of Consumer Affairs and the Attorney General under the Consumer Fraud Act, never by a private plaintiff.
• Do not rely on a notice-and-cure opportunity before an enforcement action. New Jersey's cure window ran until July 1, 2026.

N.J. Stat. §§ 56:8-166.4 to 56:8-166.19 · Read the law's page

• Give a New Jersey consumer a means to confirm, access, correct, delete, and port their personal data, and respond within 45 days of receipt (extendable once by 45 days).
• Recognize a user-selected universal opt-out mechanism for targeted advertising and sale of personal data. This duty became operative around July 15, 2025, separately from NJDPA's general effective date.

N.J. Stat. §§ 56:8-166.4 to 56:8-166.19 · Read the law's page

• Obtain a New Jersey consumer's opt-in consent before processing sensitive data, including biometric data, financial account information, or data revealing a mental or physical health condition, treatment, or diagnosis.
• Treat facial mapping, facial geometry, or facial templates, or an identifier derived from a photograph, video, or audio recording to identify a specific individual, as NJDPA biometric data. New Jersey's definition claws this back rather than excluding it outright.
• Do not sell a New Jersey consumer's sensitive data, whatever the number of consumers whose data you control or process.

New Jersey Data Privacy Act, N.J. Stat. §§ 56:8-166.4 and 56:8-166.14 · Read the law's page

• To treat data as de-identified under NJDPA's general test, take reasonable measures to ensure that the data cannot be associated with an individual (P.L. 2023, c. 266, section 1, definition of "de-identified data").
• Publicly commit to maintain and use the data only in a de-identified fashion and not to attempt to re-identify it (P.L. 2023, c. 266, section 1, definition of "de-identified data").
• Contractually obligate any recipients of the data to comply with the requirements of the definition (P.L. 2023, c. 266, section 1, definition of "de-identified data").
• Alternatively, de-identify the data in accordance with the requirements in 45 C.F.R. Part 164 and contractually prohibit any recipients of that data from attempting to reidentify it (P.L. 2025, c. 367, section 2, definition of "de-identified data").

Data broker and data collector registry, N.J. Stat. §§ 56:8-166.20 and 56:8-166.21 (P.L.2026, c.25, sections 2 and 4) · Read the law's page

• The Division of Consumer Affairs' duty to establish the public registry in section 2(b) is inoperative for 270 days following enactment on June 30, 2026; the rest of the act took effect on enactment (P.L.2026, c.25, section 8).
• If you are a data broker, meaning a person or entity that knowingly collects or purchases the personal data of a New Jersey consumer you have no direct relationship with and sells or licenses it to a third party, register with the Division of Consumer Affairs every year and pay the registration fee (N.J.S.A. 56:8-166.20(c)(1)).
• If you are a data collector, meaning a business that knowingly collects the personal data of consumers it has a direct relationship with and sells or licenses it to a data broker, register with the Division every year and pay the registration fee (N.J.S.A. 56:8-166.20(c)(1)).
• Pay a registration fee set by the number of New Jersey consumers whose personal data you sell or license, from $5,000 for 100,000 consumers or fewer up to $1,500,000 for more than 4.5 million (N.J.S.A. 56:8-166.20(c)(2)).
• Submit at registration, and update at least annually or as often as the Division requires, your name and primary physical, email and website addresses, whether and how people may opt out of or direct deletion of your data, the collection, databases and sales from which an individual cannot opt out, whether you credential purchasers, your history of data breaches and cybersecurity events and the number of people each affected, a separate statement on the personal data of people under 18, any other information the Division's regulations require, and the processors who process personal data for you (N.J.S.A. 56:8-166.20(d)).
• Check whether an exclusion applies before registering: the section does not reach HIPAA protected health information, Gramm-Leach-Bliley financial institutions, insurance institutions and insurance-support organizations, consumer reporting agencies acting under the Fair Credit Reporting Act, State agencies and political subdivisions, human subjects research, and registered national securities associations, and a sale that is incidental to an e-commerce or application platform, directory assistance, certain public-information services or regulated title services does not make you a data broker (N.J.S.A. 56:8-166.20(e) and (g)).

Data broker sensitive data ban, N.J. Stat. §§ 56:8-166.22 and 56:8-166.23 (P.L.2026, c.25, sections 3 and 5) · Read the law's page

• If you are a data broker or a data collector, do not sell or license sensitive data to any other individual or entity (N.J.S.A. 56:8-166.22(a)).
• Treat as sensitive data any personal data revealing racial or ethnic origin, religious beliefs, health condition, treatment or diagnosis, financial account information with its access code, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric data processed to uniquely identify an individual, personal data collected from a known child, and precise geolocation data within a radius of 1,750 feet (N.J.S.A. 56:8-166.20(a) and 56:8-166.22(a)).
• Check whether an exclusion applies before relying on it: the ban does not reach HIPAA protected health information, Gramm-Leach-Bliley financial institutions, insurance institutions and insurance-support organizations, consumer reporting agencies acting under the Fair Credit Reporting Act, the Motor Vehicle Commission's sales that the Driver's Privacy Protection Act permits, State agencies and political subdivisions, human subjects research, and registered national securities associations (N.J.S.A. 56:8-166.22(b)).

Privacy Protection Act, health care facilities, N.J. Stat. § 26:2H-5.37 (P.L.2026, c.4, section 6) · Read the law's page

• This section does not bind a health care facility until the first day of the 13th month next following enactment of P.L.2026, c.4, which was approved on March 25, 2026 (P.L.2026, c.4, section 9).
• If you are a health care facility, do not request or collect information relating to a patient's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number, except when it is necessary to ensure the safe and appropriate delivery of health care services, including assessment, treatment, transfer, referral, billing or discharge, as State or federal law requires, or to assess eligibility for, or to provide or administer, a public service, benefit or program (N.J.S.A. 26:2H-5.37(a)).
• Do not disclose that information when it is kept to assess eligibility for or to administer a health care service, benefit or program, except as federal or State law requires for eligibility, as a valid judicial order, judicial warrant or federal law requires, or with the patient's knowing written consent (N.J.S.A. 26:2H-5.37(b) and (c)).
• Obtain written consent that states the exact record or information to be shared, the purpose of sharing it, that consent is voluntary and declining it brings no discrimination or retaliation, that consent may be revoked without affecting information already shared, and the person or agency that will receive it; using the Department of Health's standardized form, or an interpreter-assisted process consistent with State and federal law, is deemed compliance with the consent requirements (N.J.S.A. 26:2H-5.37(c)).

N.J. Stat. §§ 56:8-23.1 to 56:8-23.7 (P.L. 2026, c. 55) · Read the law's page

• Do not use surveillance pricing, or any other pricing strategy that determines or varies the sale price of groceries and other foodstuffs based, in whole or in part, on personal data.
• Surveillance pricing includes pricing of groceries and other foodstuffs that an algorithm or automated system determines, adjusts, optimizes, or recommends using personal data, including data derived or inferred from other data, where the result is price variation for individual consumers or groups of consumers, and pricing based on data collected through electronic surveillance technology such as sensors, cameras, device tracking, and biometric monitoring.
• You may still offer a different price on groceries and other foodstuffs based upon reasonable costs of providing them to different consumers, upon a bona fide discount whose eligibility conditions are disclosed and uniformly offered, or upon a bona fide discount offered as part of a loyalty program.
• Use personal data that you employ to offer a difference in price on those grounds for no other purpose without the consumer's consent.
• The act does not reach food or beverages sold by an establishment primarily engaged in preparing and selling food or beverages for immediate consumption.