--- title: "New Jersey privacy law (NJDPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/new-jersey/controller-duties" source: "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- New Jersey Data Privacy Act # New Jersey privacy law (NJDPA): controller duties Law as of October 28, 2026 ยท [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must publish a privacy notice covering data categories, purposes, third-party categories, shared data, how to exercise and appeal rights, how material changes are notified, and a working contact email or online mechanism. They must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and run documented data protection assessments for targeted advertising, risky profiling, sale and sensitive data. Since 15 July 2025 they must honour a user-selected universal opt-out mechanism for targeted advertising and sale. ## Key points 1. Privacy notice: data categories, purposes, categories of third parties, categories of data shared, how to exercise and appeal rights, how material changes are notified with the notice's effective date, and an active email or online contact. Section: [C.56:8-166.6(a)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 2. Sale, targeted advertising and significant-effect profiling must be disclosed clearly and conspicuously, with how to opt out. Section: [C.56:8-166.6(b)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 3. Collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes; no incompatible secondary use without consent. Section: [C.56:8-166.12(a)(1) and (2)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 4. Data protection assessments required before processing that presents a heightened risk (targeted advertising, risky profiling, sale, sensitive data), for data acquired on or after the effective date; available to the Division on request. Section: [C.56:8-166.12(a)(10), (b) and (c)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 5. Universal opt-out mechanism must be honoured for targeted advertising and sale from not later than six months after the effective date (15 July 2025). Section: [C.56:8-166.11(b)(1)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) 6. Reasonable administrative, technical and physical security appropriate to the volume and nature of the data. Section: [C.56:8-166.12(a)(3)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) ## Sources - [P.L.2023, c.266 (S332 6R), chapter law text with compiled sections C.56:8-166.4 to 166.19](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) - [P.L.2026, c.25 (A5328 1R), chapter law text](https://pub.njleg.state.nj.us/Bills/2026/PL26/25_.HTM) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the New Jersey statute](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) Reference material, not legal advice. ## Other topics for New Jersey - [Applicability](https://dposchool.com/state-privacy-laws/state/new-jersey/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-jersey/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-jersey/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/new-jersey/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/new-jersey/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-jersey/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/new-jersey/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents