Law / United States / 
New Jersey
New Jersey Data Privacy Act (NJDPA), general applicability and scope
N.J. Stat. §§ 56:8-166.4 to 56:8-166.19
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Limit your collection of a New Jersey resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose disclosed to the consumer.
- Determine whether NJDPA's applicability thresholds and sector exemptions reach your business before assuming coverage or exemption either way.
These lines are LexLint's reading of the law's text. Also read by: New Jersey Division of Consumer Affairs, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Division's proposals page lists a proposed new rule on data privacy, N.J.A.C. 13:45L, which is a proposal and not guidance.
- As of
- Guidance link
- https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx
- Guidance body
- New Jersey Division of Consumer Affairs, Office of the Attorney General
- Open questions
- Does a controller 'receive a discount on the price of any goods or services' from the sale of personal data, so that the 25,000-consumer threshold in section 2.b of P.L. 2023, c. 266 applies to it, when it receives a free or reduced-price analytics or advertising service in exchange for the data?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller may not conduct processing that presents a heightened risk of harm (targeted advertising or profiling with a foreseeable risk of harm, sale of personal data, processing sensitive data) without conducting and documenting a data protection assessment of each such activity involving personal data acquired on or after the effective date. It must make the assessment available to the Division of Consumer Affairs on request, and the Division may evaluate it for compliance. Section 9 sets no period for keeping the assessment and lists no event fields, so the content is coded as the weighing of benefits against risks only. The act reaches controllers that conduct business in the State or produce products or services targeted to its residents (section 2), and a consumer is defined as a resident (section 1).
- Kind
- Implicit
- As of
- Provision
- N.J.S.A. 56:8-166.4 et seq., P.L. 2023, c. 266, section 9(a)(10) and (b) (a documented data protection assessment of each heightened-risk processing activity, made available to the Division of Consumer Affairs on request)
- Trigger
- personal_data_processing
What this law does
NJDPA governs private-sector processing of New Jersey residents' personal data, enacted as P.L. 2023, c. 266 (S332), signed . Its own uncodified section 17 sets the effective date at the 365th day following enactment, .
A controller must limit collection of personal data to what is adequate, relevant, and reasonably necessary, the ordinary multi-state "reasonably necessary" standard rather than Maryland's stricter "strictly necessary" gate, and enforcement runs through the general Consumer Fraud Act framework.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .