DPO SchoolDPO School

New Jersey Data Privacy Act

New Jersey privacy law (NJDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act applies to controllers that do business in New Jersey or target products or services to its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers (not counting data used only to complete a payment), or of at least 25,000 consumers while earning any revenue or receiving any discount from selling personal data. There is no revenue-only test and no general exemption for nonprofits or higher education. GLBA financial institutions and their affiliates, insurance institutions, state agencies and political subdivisions are excluded, while HIPAA protected health information and FCRA-governed data are exempt at data level. People acting in a commercial or employment context are not consumers.

Key points

  1. Threshold 1: personal data of 100,000 or more New Jersey consumers in a calendar year, excluding data processed only to complete a payment.

    Section: C.56:8-166.5(a)

  2. Threshold 2: personal data of 25,000 or more consumers plus any revenue, or any discount on goods or services, from selling personal data (no percentage test).

    Section: C.56:8-166.5(b)

  3. Excluded: a financial institution, data, or an affiliate subject to Title V of the Gramm-Leach-Bliley Act; secondary market institutions; insurance institutions under P.L.1985, c.179.

    Section: C.56:8-166.13(b) to (d)

  4. Exempt at data level: HIPAA protected health information held by covered entities or business associates, FCRA-governed consumer reporting data, and human subjects research data.

    Section: C.56:8-166.13(a), (f), (h)

  5. State agencies, political subdivisions and their instrumentalities are excluded.

    Section: C.56:8-166.13(g)

  6. No exemption for nonprofits or institutions of higher education appears in the Act.

    Section: C.56:8-166.13

  7. A consumer is a resident acting only in an individual or household context; employees and business-to-business contacts are outside the definition.

    Section: C.56:8-166.4

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the New Jersey statute

Reference material, not legal advice.