New Jersey Data Privacy Act
New Jersey's comprehensive consumer privacy statute (P.L.2023, c.266, N.J.S.A. 56:8-166.4 et seq., in force 15 January 2025), as amended on 30 June 2026 by P.L.2026, c.25: privacy notices, consumer rights to access, correct, delete, port and opt out of targeted advertising, sale and significant profiling, a universal opt-out mechanism, 45-day responses and appeals, minimisation, security, opt-in consent for sensitive data and for teens aged 13 to 16, data protection assessments, processor contracts, a ban on selling sensitive data that applies to every business regardless of size, and registration of data brokers and data collectors. Enforced by the Attorney General under the Consumer Fraud Act; the cure period ended on 1 July 2026 and the proposed rules expired unadopted. Built on the chaptered Act and the 2026 amending bill, read in full.
New Jersey Data Privacy Act is a compliance framework from United States - New Jersey with 6 domains and 35 controls that map to 141 other frameworks. The largest domains are Controller duties – New Jersey Data Privacy Act (12 controls), Consumer rights and opt-out mechanisms – New Jersey Data Privacy Act (7 controls), Consumer requests, authentication and appeals – New Jersey Data Privacy Act (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Consumer requests, authentication and appeals – New Jersey Data Privacy Act
| Code | Title |
|---|---|
| new-jersey-data-privacy-act::56:8-166.7(a) | Respond to verified requests within 45 days, extendable once by 45 |
| new-jersey-data-privacy-act::56:8-166.7(c) | Tell the consumer why a request is declined and how to appeal |
| new-jersey-data-privacy-act::56:8-166.7(d) | Free once per twelve months; fees or refusal only for manifestly unfounded, excessive or repetitive requests |
| new-jersey-data-privacy-act::56:8-166.7(e) | Authenticate rights requests; do not authenticate opt-outs; documented fraud denials |
| new-jersey-data-privacy-act::56:8-166.7(f) | Appeal process with a written decision in 45 days and a route to the Division |
Consumer rights and opt-out mechanisms – New Jersey Data Privacy Act
| Code | Title |
|---|---|
| new-jersey-data-privacy-act::56:8-166.10(a)(1) | Right to confirm processing and to access personal data |
| new-jersey-data-privacy-act::56:8-166.10(a)(2) | Right to correct inaccuracies |
| new-jersey-data-privacy-act::56:8-166.10(a)(3) | Right to delete, including data obtained from other sources |
| new-jersey-data-privacy-act::56:8-166.10(a)(4) | Right to a portable copy |
| new-jersey-data-privacy-act::56:8-166.10(a)(5) | Right to opt out of targeted advertising, sale and significant-effect profiling |
| new-jersey-data-privacy-act::56:8-166.11(a) | Honour opt-outs from authorised agents, including browser and device signals |
| new-jersey-data-privacy-act::56:8-166.11(b) | Recognise a user-selected universal opt-out mechanism from 15 July 2025 |
Controller duties – New Jersey Data Privacy Act
| Code | Title |
|---|---|
| new-jersey-data-privacy-act::56:8-166.12(a)(1) | Data minimisation: collect only what is adequate, relevant and reasonably necessary |
| new-jersey-data-privacy-act::56:8-166.12(a)(10) | Data protection assessment before heightened-risk processing |
| new-jersey-data-privacy-act::56:8-166.12(a)(2) | Purpose limitation: consent for incompatible secondary uses |
| new-jersey-data-privacy-act::56:8-166.12(a)(3) | Reasonable administrative, technical and physical data security |
| new-jersey-data-privacy-act::56:8-166.12(a)(4) | Consent before processing sensitive data; COPPA for known children |
| new-jersey-data-privacy-act::56:8-166.12(a)(5) | No processing in violation of anti-discrimination laws |
| new-jersey-data-privacy-act::56:8-166.12(a)(6) | No sale of sensitive data, whatever the controller's size (added 30 June 2026) |
| new-jersey-data-privacy-act::56:8-166.12(a)(7) | Consent revocation as easy as giving it; stop within 15 days |
| new-jersey-data-privacy-act::56:8-166.12(a)(8) | Consent for targeted advertising, sale or significant profiling of teens aged 13 to 16 |
| new-jersey-data-privacy-act::56:8-166.12(a)(9) | Specify the express purposes of processing |
| new-jersey-data-privacy-act::56:8-166.12(b) | Assessment content and production to the Division on request |
| new-jersey-data-privacy-act::56:8-166.15(d) | Processing under an exemption: purpose-limited, proportionate, burden on the controller |
Data brokers and data collectors (P.L.2026, c.25) – New Jersey Data Privacy Act
| Code | Title |
|---|---|
| new-jersey-data-privacy-act::PL2026-c25-s2(c) | Annual registration and fee for data brokers and data collectors |
| new-jersey-data-privacy-act::PL2026-c25-s2(d) | Registration disclosures, updated at least annually |
| new-jersey-data-privacy-act::PL2026-c25-s3 | Data brokers and data collectors may never sell or license sensitive data |
Privacy notice, disclosures and non-discrimination – New Jersey Data Privacy Act
| Code | Title |
|---|---|
| new-jersey-data-privacy-act::56:8-166.6(a) | Privacy notice with the seven required contents |
| new-jersey-data-privacy-act::56:8-166.6(b) | Clear and conspicuous disclosure of sale, targeted advertising and significant profiling |
| new-jersey-data-privacy-act::56:8-166.6(c) | No new account to exercise rights; no penalty for exercising them |
| new-jersey-data-privacy-act::56:8-166.8 | Non-discrimination for opting out; disclosed loyalty and incentive programmes |
Processors and processing contracts – New Jersey Data Privacy Act
| Code | Title |
|---|---|
| new-jersey-data-privacy-act::56:8-166.16(b) | Processor follows instructions and assists the controller |
| new-jersey-data-privacy-act::56:8-166.16(c) | Processor confidentiality duty and written subcontractor flow-down |
| new-jersey-data-privacy-act::56:8-166.16(d) | Security appropriate to risk with a clear allocation between controller and processor |
| new-jersey-data-privacy-act::56:8-166.16(e) | Binding controller-processor contract with the statutory terms |
Your Compliance Coverage
If you comply with New Jersey Data Privacy Act, you already cover:
Turkey KVKK
12%
5 controls mapped
Compare →Privacy Act 1988 (Australia)
12%
5 controls mapped
Compare →Pakistan Personal Data Protection Bill 2023
12%
5 controls mapped
Compare →+ 138 more: NIST SP 800-122 (12%), Nigeria Data Protection Regulation (NDPR) (12%)
See all 141 mapped frameworks ↓Maps to 141 other frameworks
Coverage is not the same as your position
This page shows what New Jersey Data Privacy Act overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is New Jersey Data Privacy Act and who does it apply to?
New Jersey Data Privacy Act is a compliance framework from United States - New Jersey with 6 domains and 35 controls. New Jersey's comprehensive consumer privacy statute (P.L.2023, c.266, N.J.S.A. 56:8-166.4 et seq., in force 15 January 2025), as amended on 30 June 2026 by P.L.2026, c.25: privacy notices, consumer rights to access, correct, delete, port and opt out of targeted advertising, sale and significant profiling, a universal opt-out mechanism, 45-day responses and appeals, minimisation, security, opt-in consent for sensitive data and for teens aged 13 to 16, data protection assessments, processor contracts, a ban on selling sensitive data that applies to every business regardless of size, and registration of data brokers and data collectors. Enforced by the Attorney General under the Consumer Fraud Act; the cure period ended on 1 July 2026 and the proposed rules expired unadopted. Built on the chaptered Act and the 2026 amending bill, read in full. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does New Jersey Data Privacy Act actually require?
New Jersey Data Privacy Act has 35 controls organised across 6 domains. The largest domains are Controller duties – New Jersey Data Privacy Act (12 controls), Consumer rights and opt-out mechanisms – New Jersey Data Privacy Act (7 controls), Consumer requests, authentication and appeals – New Jersey Data Privacy Act (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of New Jersey Data Privacy Act do I already cover?
New Jersey Data Privacy Act maps to 141 other compliance frameworks. The top mapping partners are Turkey KVKK (12% coverage), Privacy Act 1988 (Australia) (12% coverage), Pakistan Personal Data Protection Bill 2023 (12% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement New Jersey Data Privacy Act?
Start your New Jersey Data Privacy Act compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about New Jersey Data Privacy Act requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 35 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required