New Jersey Data Privacy Act (NJDPA), general applicability and scope

N.J. Stat. §§ 56:8-166.4 to 56:8-166.19

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 January 2025.

A comprehensive regime rule binding private bodies.

As of 27 August 2026.

What it requires

Limit your collection of a New Jersey resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose disclosed to the consumer.
Determine whether NJDPA's applicability thresholds and sector exemptions reach your business before assuming coverage or exemption either way.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

NJDPA governs private-sector processing of New Jersey residents' personal data, enacted as P.L. 2023, c. 266 (S332), signed January 16, 2024. Its own uncodified section 17 sets the effective date at the 365th day following enactment, January 15, 2025.

A controller must limit collection of personal data to what is adequate, relevant, and reasonably necessary, the ordinary multi-state "reasonably necessary" standard rather than Maryland's stricter "strictly necessary" gate, and enforcement runs through the general Consumer Fraud Act framework.

When LexLint raises it

automated_outreach
crawls_web
deploys_chatbot
processes_biometrics
processes_voice
trains_models

Read the law

official New Jersey session law text, P.L. 2023, c. 266, New Jersey Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app