Navigating the New Jersey Data Privacy Act (NJDPA): Key Details

The NJDPA applies to businesses operating in New Jersey or offering products and services to its residents. It covers entities that collect or process the personal data of at least 100,000 consumers annually, excluding data processed exclusively for payment transactions or those that collect or process personal data of at least 25,000 consumers and derive revenue or receive discounts from the sale of personal data.

The Office of the Attorney General has sole authority to enforce the law, but consumers cannot take private legal action under it. The Division of Consumer Affairs Director establishes rules and regulations to implement the law's objectives.

The NJDPA does not grant a private right of action, meaning individuals cannot sue under the law. Businesses are allowed a 30-day cure period to address violations. Noncompliance penalties are $10,000 for a first violation and $20,000 for each subsequent violation.