1. Home
  2. State breach laws
  3. New Jersey

New Jersey data breach notification law

What New Jersey requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by N.J. Stat. Ann. §§ 56:8-161 to 56:8-166 (notification at § 56:8-163).

No fixed deadline
Notification deadline
Not required
AG notification
Limited
Private right of action
None
Liability protection

What this means if you sell security services

New Jersey requires a business to report a breach to the State Police before affected customers hear anything, whatever the number of residents involved, and individuals can sue over willful, knowing, or reckless violations that cost them money. Separately, the state privacy law that took effect in January 2025 adds data protection assessment duties for covered businesses. A New Jersey organization that has just filed has both a regulator conversation and a data-inventory problem, and both are services an MSP or MSSP can sell directly.

See recent New Jersey breach filings →

Requirements in detail

Statute
N.J. Stat. Ann. §§ 56:8-161 to 56:8-166 (notification at § 56:8-163)
Deadline to notify residents
In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach, with no fixed number of days. Notice must be delayed if a law enforcement agency requests it, and is not required if the business documents in writing that misuse of the information is not reasonably possible.
Attorney General notification
No, the Attorney General is not a required recipient. Instead, the business must report the breach to the Division of State Police in the Department of Law and Public Safety before notifying customers, whatever the number of residents affected. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 people are notified at one time.
Penalties
A willful, knowing, or reckless violation is an unlawful practice under the Consumer Fraud Act, enforced by the Attorney General through the Division of Consumer Affairs. Civil penalties are up to $10,000 for a first offense and up to $20,000 for each later offense.
Private right of action
Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.
Encryption exemption
New Jersey's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. New Jersey has no law limiting breach lawsuits for organizations that maintain a security program.

New Jersey breach notification FAQ

What is the data breach notification deadline in New Jersey?

In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach, with no fixed number of days. Notice must be delayed if a law enforcement agency requests it, and is not required if the business documents in writing that misuse of the information is not reasonably possible. The governing law is N.J. Stat. Ann. §§ 56:8-161 to 56:8-166 (notification at § 56:8-163).

Does New Jersey require notifying the Attorney General of a data breach?

No, the Attorney General is not a required recipient. Instead, the business must report the breach to the Division of State Police in the Department of Law and Public Safety before notifying customers, whatever the number of residents affected. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 people are notified at one time.

What are the penalties for failing to report a data breach in New Jersey?

A willful, knowing, or reckless violation is an unlawful practice under the Consumer Fraud Act, enforced by the Attorney General through the Division of Consumer Affairs. Civil penalties are up to $10,000 for a first offense and up to $20,000 for each later offense.

Can individuals sue over a data breach in New Jersey?

Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.

Does encrypted data need to be reported in New Jersey?

New Jersey's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does New Jersey limit breach lawsuits for companies with a cybersecurity program?

No. New Jersey has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the New Jersey Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →