US — New JerseyNew Jersey Data Privacy Act (NJDPA): Complete Compliance Guide
Overview
The New Jersey Data Privacy Act (NJDPA) requires businesses that collect personal data from consumers to notify them about the collection and sharing of their data. It aims to provide transparency in data handling, enhance consumer control over personal data, and regulate the sale and processing of sensitive information. The law applies to certain for-profit entities, establishing obligations for data security, consent, and consumer rights.
Does the New Jersey Data Privacy Act Apply to Your Business?
The NJDPA applies to businesses that meet at least one of its thresholds. Use this tool to check whether it applies to yours.
New Jersey Data Privacy Act Scope Checker
Answer two questions to determine whether the NJDPA applies to your organization.
Note: the NJDPA applies based on New Jersey residents' data, regardless of where your business is located.
New Jersey Consumer Rights Under the NJDPA
The NJDPA grants seven individual privacy rights to New Jersey residents. Businesses must respond to authenticated requests within 45 days. A 45-day extension is available with written notice to the consumer.
Request access to the information we have collected about you
45-day response windowCorrect inaccurate or incomplete information we have collected about you
45-day response windowDelete personal information we have collected about you
45-day response windowRequest a copy of personal information we have collected about you
45-day response windowRequest that we limit how your personal information being used
45-day response windowRequest that we stop selling your personal information
45-day response windowOpt-out of targeted advertisements so that you no longer receive personalized ads
45-day response windowHow Clym Helps You Comply with the New Jersey Data Privacy Act
Clym detects browser-based Global Privacy Control signals and automatically applies opt-out status — no extra configuration needed from your dev team.
Configurable consent banner with a clear opt-out for targeted ads and data sales, and a full consent audit log.
Clym's Data Subject Request portal handles every NJDPA request type, with built-in 45-day deadline tracking and escalation alerts.
Clym scans your site and generates your NJDPA-compliant privacy notice, updated automatically when new trackers or data categories are detected.
Regulation Summary
- December 2023: NJDPA passed in the Senate and Assembly.
- January 16, 2024: Signed into law by Governor Phil Murphy.
- January 15, 2025: Law becomes enforceable.
- Applies to businesses conducting operations in New Jersey or targeting New Jersey residents.
- Businesses must meet one of the following thresholds:
- Control or process personal data of at least 100,000 consumers annually (excluding payment transaction data).
- Control or process data of at least 25,000 consumers and derive revenue from the sale of personal data.
- Government entities, nonprofits, and financial institutions.
- Data regulated by HIPAA, FERPA, GLBA, and COPPA.
- Data collected for research or public health activities.
- Data Security: Implement appropriate administrative, technical, and physical safeguards.
- Transparency: Provide clear privacy notices specifying the types of data collected, purposes of processing, and third-party sharing practices.
- Purpose Limitation: Avoid secondary uses without consumer consent.
- Non-discrimination: Prohibit penalizing consumers who opt out of data sales or targeted advertising.
- Opt-Out Mechanism: Display an opt-out mechanism for data sales and targeted advertising.
- Privacy Notices: Provide detailed disclosures, including a description of consumer rights and how to exercise them.
- Data Access Requests: Respond to verified requests within 45 days, with a possible extension of another 45 days if necessary.
- Sensitive Data: Consent required for processing sensitive data (e.g., health data, biometric data).
- Data Protection Assessments: Required for processing activities involving high-risk data use (e.g., targeted advertising, profiling).
- Access: Request confirmation and access to personal data.
- Correction: Request corrections to inaccurate data.
- Deletion: Request deletion of personal data.
- Portability: Obtain personal data in a machine-readable format.
- Opt-Out: Refuse data sales and profiling decisions.
- Enforced by the New Jersey Attorney General.
- Businesses have 30 days to cure violations after notice during the first 18 months of the law's enactment.
- Civil penalties imposed as violations of New Jersey's consumer protection laws.
- No private right of action (individual lawsuits not permitted).