| name | new-jersey-dpa |
| title | New Jersey Data Privacy Act (NJDPA) |
| description | New Jersey Data Privacy Act (NJDPA) compliance, effective January 15, 2025. Covers consumer rights (access, correction, deletion, portability, opt-out), controller obligations, sensitive data requirements, universal opt-out mechanism recognition, 30-day cure period (sunsets after 18 months), and AG enforcement. Keywords: NJDPA, New Jersey, data privacy, consumer rights, sensitive data, universal opt-out, AG enforcement. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/plugins/privacy-skills-complete/skills/new-jersey-dpa |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | data-protection |
| language | en |
New Jersey Data Privacy Act (NJDPA)
Overview
The New Jersey Data Privacy Act (S332/A1971), signed into law on January 16, 2024, and effective January 15, 2025, establishes comprehensive consumer data privacy rights for New Jersey residents. The NJDPA applies to controllers that conduct business in New Jersey or produce products or services targeted to New Jersey residents and that during a calendar year either (a) control or process the personal data of at least 100,000 consumers (excluding data processed solely for completing a payment transaction), or (b) control or process the personal data of at least 25,000 consumers and derive revenue or receive a discount on the price of goods or services from the sale of personal data.
Key Provisions
Consumer Rights (Section 6)
| Right | Description | Response Period |
|---|
| Right to access | Confirm processing and obtain a copy of personal data | 45 days (extendable by 45) |
| Right to correction | Correct inaccurate personal data | 45 days |
| Right to deletion | Delete personal data provided by or obtained about the consumer | 45 days |
| Right to data portability | Obtain personal data in a portable, readily usable format | 45 days |
| Right to opt out of sale | Opt out of the sale of personal data | 15 business days |
| Right to opt out of targeted advertising | Opt out of processing for targeted advertising purposes | 15 business days |
| Right to opt out of profiling | Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects | 15 business days |
| Right to non-discrimination | Not be discriminated against for exercising rights | Ongoing |
Sensitive Data (Section 2)
The NJDPA defines sensitive data broadly, including:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health condition, treatment, or diagnosis
- Financial information (account number, credit/debit card number with required security code)
- Sex life or sexual orientation
- Citizenship or immigration status
- Status as transgender or non-binary
- Genetic or biometric data processed to identify an individual
- Personal data of a known child under 13
- Precise geolocation data
