In January, New Jersey adopted a comprehensive data privacy law that will require businesses to disclose their data privacy practices and impose limitations on the collection and use of personal data relating to New Jersey residents. The legislation, which is colloquially referred to as the New Jersey Data Privacy Act (NJDPA), goes into effect on Jan. 15, 2025. Following in the legislative footsteps of states like California and Virginia, the law imposes new regulatory requirements upon businesses in the name of protecting the privacy of the state’s residents. The New Jersey Office of the Attorney General will have exclusive enforcement authority, and there is currently no private right of action available under this act.

The NJDPA applies to a wide range of businesses, both within and outside New Jersey, as long as they meet certain criteria. The NJDPA regulates the “processing” of personal data, which is broadly defined to mean any operation performed on personal data, including the collection, use, storage, disclosure, analysis, deletion, or modification of data.