New Jersey Privacy Compliance Checklist

New Jersey Data Privacy Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

What is the NJDPA compliance checklist?

The NJDPA compliance checklist is a 13-step plan for meeting the New Jersey Data Privacy Act (NJDPA), New Jersey's consumer privacy law, which took effect January 15, 2025. It is enforced by the New Jersey Attorney General (Division of Consumer Affairs, Office of Consumer Protection), with civil penalties up to $10,000 per violation and no cure period. Work through every step below, then confirm your specific obligations with the free applicability calculator.

Compliance Steps

Effective: January 15, 20250

1
Determine applicability: assess whether you process personal data of 100,000+ NJ consumers (excluding payment-only data) OR 25,000+ consumers while deriving any revenue from data sales — note that NJ has no minimum revenue percentage threshold unlike CT/VA (25%) or other states. Check entity-level HIPAA and GLBA exemptions
2
Implement GPC/universal opt-out signal recognition: detect and honor Global Privacy Control signals for opt-out-of-sale and opt-out-of-targeted-advertising, ensure downstream propagation to processors and third-party recipients, test across all major browsers, and log all signal receipt and processing for compliance documentation
3
Update privacy notices with all NJDPA-required disclosures: categories of personal data processed, purposes, categories of third parties receiving data, consumer rights and how to exercise them, sensitive data processing practices, and sale/targeted advertising disclosures. Reference proposed regulations for specific format requirements once finalized
4
Build consumer rights request intake and fulfillment system: support access, correction, deletion, and portability requests with 45-day initial response window plus 45-day extension when reasonably necessary. Acknowledge receipt within 10 business days per proposed regulations. Maintain logs of all requests for at least 24 months
5
Obtain opt-in consent for all sensitive data processing: implement clear, affirmative consent mechanisms for all 9 sensitive data categories (racial/ethnic origin, religious beliefs, health data, sexual orientation, citizenship/immigration status, genetic data, biometrics, children's data, precise geolocation). Avoid dark patterns per proposed regulations
6
Implement minor protection controls: prohibit sale of personal data and targeted advertising for consumers under 17 without affirmative consent, require opt-in for all processing of known children under 13 data. Age-gate or age-verify where feasible to prevent inadvertent violations
7
Establish appeals process for denied consumer requests: provide clear mechanism for consumers to appeal, respond to appeals within a reasonable timeframe, and if the appeal is denied, inform the consumer how to file a complaint with the Division of Consumer Affairs
8
Conduct data protection assessments for high-risk processing: targeted advertising, sale of personal data, processing of sensitive data, and profiling with risk of unfair treatment or disparate impact. Document benefit-vs-risk analysis and maintain assessments for AG review upon request
9
Review and update processor contracts: ensure all data processing agreements include NJDPA-compliant provisions on data use limitations, confidentiality, subcontractor flow-down requirements, and assistance with consumer rights requests. Refresh pre-2025 contracts
10
Implement data minimization and retention practices: collect only data reasonably necessary for disclosed purposes, establish retention schedules, and document justification for data retained beyond 12 months. Proposed regulations will require maintaining a data inventory
11
Operate under post-cure-period enforcement (in force since July 1, 2026): maintain an AG-inquiry response playbook — (1) designate a privacy response team and external counsel contact, (2) document all compliance measures proactively, (3) keep a rapid-response process for AG notices ready, since cure is now discretionary rather than guaranteed, (4) run a compliance audit now if you have not already, as there is no longer a statutory window to remediate after notice, (5) monitor proposed regulation adoption for additional requirements
12
Check data broker registration: if your business qualifies as a data broker under NJ's separate data broker law, register annually with the Division of Consumer Affairs and comply with additional broker-specific obligations
13
Map multistate compliance obligations: compare NJDPA requirements against CT CTDPA, DE DPDPA, MD MODPA, and other northeastern state laws to identify conflicts and build unified compliance processes. NJ's broader sensitive data definition and stronger minor protections may require NJ-specific controls even if compliant with other states

Key Enforcement Details

Enforced By

New Jersey Attorney General (Division of Consumer Affairs, Office of Consumer Protection)

Penalty / Violation

$10,000

Cure Period

None

Private Right of Action

Related Resources

New Jersey Privacy Law — Full Guide
Compare New Jersey with Other States
New Jersey Enforcement Actions & Privacy Fines
2026-2027 Privacy Law Compliance Deadlines
All State Privacy Laws

NJDPA Compliance Checklist FAQ

What is the NJDPA compliance checklist?

It is a 13-step plan organizations use to meet the New Jersey Data Privacy Act (NJDPA), which took effect January 15, 2025. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under New Jersey law.

Who has to comply with the New Jersey Data Privacy Act?

The NJDPA generally applies to organizations that handle New Jersey residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for NJDPA non-compliance?

The New Jersey Attorney General (Division of Consumer Affairs, Office of Consumer Protection) can impose civil penalties of up to $10,000 per violation and no cure period. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put NJDPA Into Practice on Your Site

Termly builds and maintains a New Jersey-ready privacy policy, a consent banner that recognizes universal opt-out signals like GPC, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests NJDPA grants.

Affiliate link — we may earn a commission, at no cost to you.

Start Free with Termly

Does this law apply to you?

Use our free calculator to check if New Jersey Data Privacy Act applies to your business.

Check Applicability

Official Resources

NJDPA Full Text — S332 (New Jersey Legislature)
NJ Division of Consumer Affairs — Data Privacy Law FAQ
NJ AG Proposed NJDPA Rules Announcement (June 2, 2025)
NJ Division of Consumer Affairs — Rule Proposals & Adoptions
NJ Office of Attorney General — Data Privacy & Cybersecurity
File a Consumer Complaint (NJ Division of Consumer Affairs)