Law / United States / 
New Jersey
New Jersey Identity Theft Prevention Act, breach notification
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Report a breach of security involving computerized personal records to the New Jersey Division of State Police before notifying the affected customer.
- Disclose the breach to each affected New Jersey resident in the most expedient time possible and without unreasonable delay. New Jersey sets no fixed numeric-day cap.
These lines are LexLint's reading of the law's text. Also read by: New Jersey Division of Consumer Affairs, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.njconsumeraffairs.gov/News/Consumer%20Briefs/identity-theft-a-guide-for-businesses.pdf
- Guidance body
- New Jersey Division of Consumer Affairs, Office of the Attorney General
- Open questions
- Must a business wait until the Division of State Police or another law enforcement agency clears disclosure before it notifies a customer under N.J. Stat. 56:8-163, as the Division's guide for businesses says, when subsection c.(2) delays notification only if a law enforcement agency determines that notification will impede an investigation and has requested the delay?
What it makes you log
What the log must hold
Decision basis
Log retention
The documented determination is retained for five years.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Notice to a resident customer is excused when the business or public entity establishes that misuse is not reasonably possible, and that determination must be documented in writing and kept for five years. It is the only record the section requires. The advance report of a breach to the Division of State Police (subsection c) and the notices to customers and to consumer reporting agencies are notifications, not records kept. The section says nothing about who may inspect the determination, when it is audited or what it must contain beyond the determination itself, and does not say from what date the five years run.
- Kind
- Explicit
- As of
- Provision
- N.J.S.A. 56:8-163(a) (a determination that misuse of the breached information is not reasonably possible, which excuses notice to customers, must be documented in writing and retained for five years)
- Trigger
- security_incident
What this law does
The New Jersey Identity Theft Prevention Act, a separate and older statute enacted as P.L. 2005, c. 226, took effect , the first January 1 following its approval, per the act's own uncodified effective-date section (the breach-notification duty is not among the sections the act separately made effective immediately).
A business conducting business in New Jersey that compiles or maintains computerized records including personal information must disclose a breach of security to an affected New Jersey resident in the most expedient time possible and without unreasonable delay, with no fixed numeric-day deadline. A distinctive New Jersey feature requires reporting the breach to the Division of State Police in advance of notifying the customer.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .