DPO SchoolDPO School

New Jersey Data Privacy Act

New Jersey privacy law (NJDPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must follow the controller's instructions and help it answer rights requests, meet security and breach duties, and carry out assessments. A binding contract must set out instructions, nature and purpose, data types, duration, and the parties' rights and obligations, and must require deletion or return of data, compliance information, and audits or an independent assessment. A processor that decides purposes and means on its own becomes a controller for that processing.

Key points

  1. Processors must assist the controller with rights requests, security and breach notification, and data protection assessments.

    Section: C.56:8-166.16(b)

  2. Each person processing the data must be under a duty of confidentiality, and subcontractors must be engaged under written contracts with the same obligations.

    Section: C.56:8-166.16(c)

  3. The contract must set out processing instructions, nature and purpose, data types, duration, and both parties' rights and obligations.

    Section: C.56:8-166.16(e)(1) and (2)

  4. The contract must require deletion or return of data at the end of services (unless law requires retention), compliance information on request, and assessments by the controller or, with consent, an annual independent assessment.

    Section: C.56:8-166.16(e)(4)

  5. A contract cannot relieve either party of its liabilities under the Act.

    Section: C.56:8-166.16(f)

  6. Whether a person is a controller or processor is a fact-based question; a processor that goes beyond instructions is treated as a controller.

    Section: C.56:8-166.16(g)

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the New Jersey statute

Reference material, not legal advice.