Law note · New Jersey
New Jersey Data Privacy Act (NJDPA), general applicability and scope
NJDPA governs private-sector processing of New Jersey residents' personal data, enacted as P.L. 2023, c. 266 (S332), signed January 16, 2024. Its own uncodified section 17 sets the effective date at the 365th day following enactment, January 15, 2025.
A controller must limit collection of personal data to what is adequate, relevant, and reasonably necessary, the ordinary multi-state "reasonably necessary" standard rather than Maryland's stricter "strictly necessary" gate, and enforcement runs through the general Consumer Fraud Act framework.
What it asks of an app
- Limit your collection of a New Jersey resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose disclosed to the consumer.
- Determine whether NJDPA's applicability thresholds and sector exemptions reach your business before assuming coverage or exemption either way.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official New Jersey session law text, P.L. 2023, c. 266, New Jersey Legislature