New Jersey privacy law (NJDPA): controller duties

Key points

1. Privacy notice: data categories, purposes, categories of third parties, categories of data shared, how to exercise and appeal rights, how material changes are notified with the notice's effective date, and an active email or online contact.

   Section: C.56:8-166.6(a)

2. Sale, targeted advertising and significant-effect profiling must be disclosed clearly and conspicuously, with how to opt out.

   Section: C.56:8-166.6(b)

3. Collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes; no incompatible secondary use without consent.

   Section: C.56:8-166.12(a)(1) and (2)

4. Data protection assessments required before processing that presents a heightened risk (targeted advertising, risky profiling, sale, sensitive data), for data acquired on or after the effective date; available to the Division on request.

   Section: C.56:8-166.12(a)(10), (b) and (c)

5. Universal opt-out mechanism must be honoured for targeted advertising and sale from not later than six months after the effective date (15 July 2025).

   Section: C.56:8-166.11(b)(1)

6. Reasonable administrative, technical and physical security appropriate to the volume and nature of the data.

   Section: C.56:8-166.12(a)(3)

Sources

• P.L.2023, c.266 (S332 6R), chapter law text with compiled sections C.56:8-166.4 to 166.19
• P.L.2026, c.25 (A5328 1R), chapter law text

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

• Article 35: Data protection impact assessment (assessments)