New Jersey Adopts Comprehensive Privacy Legislation

New Jersey has joined about a dozen other states by enacting new and comprehensive privacy legislation. The law, Bill S332, was signed into law on January 16, 2024 and will take effect in January 2025.

The law applies to data controllers that do business in New Jersey or target New Jersey residents and (1) process the personal data of at least 100,000 New Jersey residents (except when the data is processed solely for the purpose of completing a payment transaction), or (2) process the personal data of at least 25,000 New Jersey residents and derive revenue from the sale of personal data.

Both "personal data" and "sensitive data" are covered by the law. Personal data is defined as non-public information that is linked or reasonably linkable to an identified or identifiable person. "Sensitive data" is "personal data" that reveals an individual's racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial