New Jersey Data Privacy Act (NJDPA): Comprehensive Overview

Discover the essentials of the NJDPA, New Jersey’s comprehensive data privacy law, designed to protect consumer rights and ensure business accountability.

The #1 cookie consent app for Shopify, trusted by 141k stores

What is NJDPA?

The New Jersey Data Privacy Act (NJDPA) is a state law aimed at safeguarding the privacy rights of New Jersey residents. Enacted to address growing concerns over data misuse, the NJDPA establishes strict guidelines for how businesses collect, use, and share personal data. It ensures transparency and empowers consumers with greater control over their personal information.

Key Provisions of the NJDPA

The NJDPA introduces several significant provisions that reshape the data privacy landscape:

1. Consumer Rights
Residents of New Jersey are granted the rights to know, access, opt out, deletion, and portability under the NJDPA.

2. Business Obligations
Businesses subject to the NJDPA must provide transparent and detailed privacy notices. Respond to consumer data requests within a specified timeframe. Enable opt-out mechanisms, including a “Do Not Sell My Personal Information” link on websites, and implement appropriate security measures to protect personal data.

Who does the NJDPA apply to?

The NJDPA applies to businesses operating in New Jersey or handling data from New Jersey residents if they generate annual revenue above a specific threshold (e.g., $25 million) and/or buy, sell, or share the personal data of at least 50,000 New Jersey residents annually and/or derive at least 50% of their revenue from selling personal data.

How Does NJDPA Compare to Other Laws?

The NJDPA shares similarities with other U.S. privacy laws, like the CCPA and VCDPA, but it also includes unique elements:

Broader Consumer Rights: Emphasizes consumer empowerment and transparency.
Stronger Enforcement: Introduces higher fines and stricter timelines for compliance.
Harmonization with GDPR: Aligns with key GDPR principles for businesses operating globally.

When will the NJDPA go into effect?

Effective January 16, 2025.

Penalties for Non-Compliance

Non-compliance with the NJDPA can result in severe penalties:

Civil Fines: Up to $7,500 per violation.
Private Right of Action: Consumers can sue for data breaches or non-compliance.
Reputational Damage: Public enforcement actions can harm a business’s credibility.

How to Comply with the NJDPA

1. Update Your Privacy Policies
Ensure your privacy policy is clear, comprehensive, and accessible to consumers.

2. Facilitate Consumer Requests
Implement systems to handle requests for data access, deletion, and opt-outs efficiently.

3. Invest in Data Security
Adopt advanced security protocols to safeguard sensitive personal data.

4. Leverage Technology
Use tools like the Pandectes GDPR Compliance App to automate compliance tasks, manage data requests, and handle cookie consent efficiently.