---
title: "New Jersey privacy law (NJDPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/new-jersey/processors"
source: "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

New Jersey Data Privacy Act

# New Jersey privacy law (NJDPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Processors must follow the controller's instructions and help it answer rights requests, meet security and breach duties, and carry out assessments. A binding contract must set out instructions, nature and purpose, data types, duration, and the parties' rights and obligations, and must require deletion or return of data, compliance information, and audits or an independent assessment. A processor that decides purposes and means on its own becomes a controller for that processing.

## Key points

1. Processors must assist the controller with rights requests, security and breach notification, and data protection assessments.

   Section: [C.56:8-166.16(b)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

2. Each person processing the data must be under a duty of confidentiality, and subcontractors must be engaged under written contracts with the same obligations.

   Section: [C.56:8-166.16(c)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

3. The contract must set out processing instructions, nature and purpose, data types, duration, and both parties' rights and obligations.

   Section: [C.56:8-166.16(e)(1) and (2)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

4. The contract must require deletion or return of data at the end of services (unless law requires retention), compliance information on request, and assessments by the controller or, with consent, an annual independent assessment.

   Section: [C.56:8-166.16(e)(4)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

5. A contract cannot relieve either party of its liabilities under the Act.

   Section: [C.56:8-166.16(f)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

6. Whether a person is a controller or processor is a fact-based question; a processor that goes beyond instructions is treated as a controller.

   Section: [C.56:8-166.16(g)](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

## Sources

- [P.L.2023, c.266 (S332 6R), chapter law text with compiled sections C.56:8-166.4 to 166.19](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the New Jersey statute](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)

Reference material, not legal advice.

## Other topics for New Jersey

- [Applicability](https://dposchool.com/state-privacy-laws/state/new-jersey/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-jersey/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-jersey/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/new-jersey/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/new-jersey/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/new-jersey/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/new-jersey/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents