---
title: "New Jersey privacy law (NJDPA): enforcement"
canonical: "https://dposchool.com/state-privacy-laws/state/new-jersey/enforcement"
source: "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

New Jersey Data Privacy Act

# New Jersey privacy law (NJDPA): enforcement

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

A violation is an unlawful practice under the Consumer Fraud Act, and the Office of the Attorney General has sole and exclusive enforcement authority. Until 1 July 2026, the Division of Consumer Affairs had to give a 30-day cure notice where it judged a cure possible; that period has ended. Consumer Fraud Act penalties apply (stated in an official legislative statement as up to $10,000 for a first offence and $20,000 for later offences), and selling sensitive data now carries $50,000 per record. There is no private right of action.

## Key points

1. Violating the Act is an unlawful practice under the Consumer Fraud Act, P.L.1960, c.39.

   Section: [C.56:8-166.17(a)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

2. The Office of the Attorney General has sole and exclusive enforcement authority; no private right of action.

   Section: [C.56:8-166.19](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

3. Cure notice and 30-day cure window applied only until the first day of the 18th month after the effective date (1 July 2026).

   Section: [C.56:8-166.17(b)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

4. Consumer Fraud Act civil penalties: up to $10,000 for a first offence and $20,000 for each later offence (figures confirmed only from an official legislative statement).

   Section: [N.J.S.A. 56:8-13](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

5. Selling, offering or licensing sensitive data: $50,000 per record; failure of a data broker or data collector to register or report: $2,500 per day.

   Section: [C.56:8-166.23; C.56:8-166.21](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

6. The Director of the Division of Consumer Affairs must adopt implementing rules; the 2025 proposal was not adopted.

   Section: [C.56:8-166.18](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

## Sources

- [P.L.2023, c.266 (S332 6R), chapter law text with compiled sections C.56:8-166.4 to 166.19](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)
- [P.L.2026, c.25 (A5328 1R), chapter law text](https://pub.njleg.state.nj.us/Bills/2026/PL26/25_.HTM)

[Compare enforcement across all states](https://dposchool.com/state-privacy-laws/topic/enforcement)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the New Jersey statute](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

Reference material, not legal advice.

## Other topics for New Jersey

- [Applicability](https://dposchool.com/state-privacy-laws/state/new-jersey/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-jersey/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-jersey/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/new-jersey/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/new-jersey/processors)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey) / Enforcement

Previous: [Processors](https://dposchool.com/state-privacy-laws/state/new-jersey/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents