New Jersey’s New Sensitive Data Law: What Employers Need To Know

On June 30, 2026, New Jersey Governor Mikie Sherrill signed Assembly Bill 5328 (A5328) into law, amending the New Jersey Data Privacy Act to impose stringent compliance requirements and significant civil penalties on individuals and legal entities that engage in covered sensitive-data activities. Most provisions took effect immediately, while the public registry is scheduled to open on April 1, 2027.

Because the Act expands the categories of regulated entities, employers and business owners should determine whether their data-sharing practices bring them within its scope. Businesses that are covered may face substantial compliance obligations and should make that assessment before the public registry opens in spring 2027.