Governance, risk & compliance
New Jersey Data Privacy Act (NJDPA) P.L.2023, c.266 as amended to 30 June 2026
The New Jersey Data Privacy Act, P.
L. 2023, c.
266 (N. J.
S. A.
56:8-166. 4 et seq.
), approved 16 January 2024 and in effect from the 365th day after enactment (15 January 2025 by calculation). It applies to controllers that conduct business in New Jersey or target its residents and, in a calendar year, control or process the personal data of at least 100,000 consumers (excluding data processed only to complete a payment transaction), or at least 25,000 consumers while earning revenue or receiving a discount from selling personal data.
It does not apply to HIPAA protected health information, GLBA financial institutions and their data, insurance institutions under N. J.
S. A.
17:23A-1 et seq. , consumer reporting agency data governed by the FCRA, State agencies and political subdivisions, and certain research.
Consumers have rights to confirm and access, correct, delete, receive a portable copy, and opt out of targeted advertising, sale and profiling for significant decisions. Controllers owe a privacy notice, data minimization, security, consent for sensitive data, consent for ages 13 to 16 before targeted advertising, sale or profiling, and data protection assessments for heightened-risk processing.
Amended by P. L.
2025, c. 367 (approved 20 January 2026), which widened several exemptions, and by P.
L. 2026, c.
25 (approved 30 June 2026), which bans the sale of sensitive data and creates annual registration, fees and penalties for data brokers and data collectors. The Attorney General alone enforces the Act and there is no private right of action; the 30-day opportunity to cure ended on 1 July 2026 (the first day of the 18th month after the effective date, by calculation).
Rules: the Division of Consumer Affairs proposed N. J.
A. C.
13:45L on 2 June 2025; a law-firm report says the proposal lapsed on 2 June 2026 without adoption. That could not be confirmed on an official source, so treat no rules as in force and watch the New Jersey Register.
Rules for data broker registration under P. L.
2026, c. 25 are also still to come.
General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses New Jersey Data Privacy Act (NJDPA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Controller | An individual or legal entity that, alone or jointly with others, determines the purpose and means of processing personal data, and meets the thresholds in s. 2 (100,000 consumers, or 25,000 with revenue or a discount from sales). Carries the notice, rights, consent, assessment and security duties. | — |
| Processor | An entity that processes personal data on behalf of a controller. Must follow the controller’s instructions, assist with requests, security, breach notice and assessments, bind its people and subcontractors, and delete or return data at the end of the service (s. 13). A processor that decides its own purposes and means is treated as a controller. | — |
| Data broker or collector | Added by P.L.2026, c.25, effective 30 June 2026. A data broker knowingly collects or purchases personal data of consumers with no direct relationship and sells or licenses it; a data collector collects from consumers it has a direct relationship with and sells or licenses it to a data broker. Annual registration and fee, required disclosures, and a flat ban on selling or licensing sensitive data. The public registry is inoperative for 270 days (until 27 March 2027 by calculation). | — |
How Lavawall® helps you get to New Jersey Data Privacy Act (NJDPA) compliance
Most of New Jersey Data Privacy Act (NJDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to New Jersey Data Privacy Act (NJDPA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against New Jersey Data Privacy Act (NJDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports New Jersey Data Privacy Act (NJDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- New Jersey Data Privacy Act (NJDPA) P.L.2023, c.266 as amended to 30 June 2026
- Category
- Privacy
- Region
- USA - New Jersey
- Levels
- 3 assessment tiers
All New Jersey, United States frameworks and training →
Map this framework freeTalk to our team