New Jersey Data Privacy Act
New Jersey privacy law (NJDPA): enforcement
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
A violation is an unlawful practice under the Consumer Fraud Act, and the Office of the Attorney General has sole and exclusive enforcement authority. Until 1 July 2026, the Division of Consumer Affairs had to give a 30-day cure notice where it judged a cure possible; that period has ended. Consumer Fraud Act penalties apply (stated in an official legislative statement as up to $10,000 for a first offence and $20,000 for later offences), and selling sensitive data now carries $50,000 per record. There is no private right of action.
Key points
Violating the Act is an unlawful practice under the Consumer Fraud Act, P.L.1960, c.39.
Section: C.56:8-166.17(a)
The Office of the Attorney General has sole and exclusive enforcement authority; no private right of action.
Section: C.56:8-166.19
Cure notice and 30-day cure window applied only until the first day of the 18th month after the effective date (1 July 2026).
Section: C.56:8-166.17(b)
Consumer Fraud Act civil penalties: up to $10,000 for a first offence and $20,000 for each later offence (figures confirmed only from an official legislative statement).
Section: N.J.S.A. 56:8-13
Selling, offering or licensing sensitive data: $50,000 per record; failure of a data broker or data collector to register or report: $2,500 per day.
Section: C.56:8-166.23; C.56:8-166.21
The Director of the Division of Consumer Affairs must adopt implementing rules; the 2025 proposal was not adopted.
Section: C.56:8-166.18
Sources
Compare enforcement across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the New Jersey statute
Reference material, not legal advice.