New Jersey Data Breach Notification Law

The New Jersey data breach notification law: State Police before customers

N.J. Stat. §§ 56:8-161 to 56:8-166 is stricter about order than about speed. From discovery or an outside tip, customers must hear in the most expedient time possible and without unreasonable delay ¹, with room for police needs, scoping and restoring systems, and no number of days.

The fixed part is who goes first. The Division of State Police, part of the Department of Law and Public Safety, must have a report of the breach and whatever is known about it before any customer letter goes out ¹.

The last amendment came in 2019; a 2026 bill aimed at timing is discussed below.

Access is enough: what counts as a New Jersey breach

Unauthorized access is the trigger here, a lower bar than the acquisition test many states use ¹. An intruder who could view the files may be enough, even without proof anything was copied out.

Two entries on the data list surprise small offices ¹:

• Online account credentials. A user name, email address or other account identifier together with a password or a security question and answer counts on its own. A phished Microsoft 365 login can be a notice event.
• Dissociated data that can be linked back. Data split apart from names still counts if the means to link it was also accessed.

Encryption, or another method making data unreadable or unusable, takes it out of scope ¹. A stolen key goes unmentioned, so if the attacker also held the credentials that decrypt the files, treat them as exposed until counsel says otherwise.

New Jersey's "not reasonably possible" exception

Letters can be skipped only if the business establishes that misuse is not reasonably possible ¹. That is a higher bar than "unlikely," and the burden sits with the business.

New Jersey wants the decision in writing and kept for five years ¹. Spell out the forensic findings, the data involved and the reason misuse cannot reasonably happen; a thin memo will not hold up if challenged.

Service providers get no such option: a firm keeping data for a client must alert that client immediately after a breach ¹.

Penalties, private suits and the pending 5-day bill

Willful, knowing or reckless violations are unlawful practices under the New Jersey Consumer Fraud Act, with that Act's penalties ². The breach law itself does not settle whether customers can sue, but the Consumer Fraud Act gives people with an ascertainable loss a suit of their own; ask counsel how that might reach you.

Bill A3339, introduced January 13, 2026, would impose a 5-business-day deadline ³. It was not law at our last check, so "without unreasonable delay" still governs. Watch it if you hold New Jersey residents' data.

A separate privacy statute, effective January 2025, covers businesses processing data on at least 100,000 New Jersey consumers a year (data used only to complete a payment excluded), or on at least 25,000 while earning revenue from selling personal data ⁴. New Jerseyans reported about $660 million in losses to IC3 in 2025, fifth highest among the states ⁵.

The New Jersey response, in order

During a live attack, an insured New Jersey company calls its carrier before anyone else, puts in an FBI report via ic3.gov, and keeps every affected machine as it is until evidence has been copied ⁶⁷⁸.

Then, in this order:

1. Have a breach response firm or the firm that handles your IT shut the attacker out.
2. Report to the State Police, before a single customer letter.
3. Split the list by home state: New Yorkers bring the 30-day New York law, Pennsylvanians the Pennsylvania law, and our deadline chart for every state covers the rest.
4. Mail customers and, past 1,000, the bureaus.
5. Check the controls carriers expect against what you actually run.

Our New Jersey managed IT guide covers local costs and what support should include.

Our reading of N.J. Stat. § 56:8-163 was compared with the statute on October 13, 2026. Use it for orientation, not as legal advice, and have New Jersey counsel confirm your duties.