Law / United States / 
New Jersey
New Jersey Data Privacy Act, de-identified data
New Jersey Data Privacy Act, N.J. Stat. §§ 56:8-166.4 and 56:8-166.14
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To treat data as de-identified under NJDPA's general test, take reasonable measures to ensure that the data cannot be associated with an individual (P.L. 2023, c. 266, section 1, definition of "de-identified data").
- Publicly commit to maintain and use the data only in a de-identified fashion and not to attempt to re-identify it (P.L. 2023, c. 266, section 1, definition of "de-identified data").
- Contractually obligate any recipients of the data to comply with the requirements of the definition (P.L. 2023, c. 266, section 1, definition of "de-identified data").
- Alternatively, de-identify the data in accordance with the requirements in 45 C.F.R. Part 164 and contractually prohibit any recipients of that data from attempting to reidentify it (P.L. 2025, c. 367, section 2, definition of "de-identified data").
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
The definition of de-identified data states the conditions for treating data as de-identified. It states no log or record duty.
- Kind
- None
- As of
What this law does
The New Jersey Data Privacy Act defines de-identified data in section 1 of P.L.2023, c.266, codified at section 56:8-166.4 of the New Jersey Statutes, as amended by section 2 of P.L.2025, c.367 (A5017), approved .
Under the first route, the data cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual or a device linked to such an individual.
The controller that possesses the data must take reasonable measures to ensure that it cannot be associated with an individual, publicly commit to maintain and use it only in a de-identified fashion and not to attempt to re-identify it, and contractually obligate any recipients to comply with those requirements.
Under the second route, which P.L.2025, c.367 added, the data is de-identified in accordance with the requirements in Part 164 of Title 45 of the Code of Federal Regulations, and any recipients of that data are contractually prohibited from attempting to reidentify it. The Act's definition of personal data does not include de-identified data.
Section 11 of P.L.2023, c.266, codified at section 56:8-166.14 of the New Jersey Statutes, provides that nothing in the Act requires a controller to re-identify de-identified data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .