Data Breach Notification Statutes – New Jersey
Last Updated: 02/28/2024
- Applicable Statute: N.J. Stat. Ann §§ 56:8-161,-163,-165
- Attorney General Notice Required: Yes, notify the Division of State Police if any resident is notified.
- Timing: Before notifying residents, must report the breach and related information pertaining to it to the Division of State Police in the Department of Law and Public Safety.
- Method: Online form at : https://www.cyber.nj.gov/breach/
- Content: See above re form.
- Consumer Notice Requirements:
- Timing: Must be made in the most expedient time possible and without unreasonable delay consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system.
- Method:
- (1) By written notice or electronic notice if consistent with E-SIGN.
- (2) If the breach involves usernames or email addresses in combination with a password or security question and answer that allows access to an online account, and does not involve any other personal information, notice may be made by email or other form directing the resident to change the password and security question or answer; or take other steps to protect the account(s)where the resident uses the same username or email address and password, or security question, or answer.
An entity that furnishes an email account cannot provide notice to the user via the same affected email account but must provide notice by another approved method or by clear and conspicuous notice delivered to the consumer online when the consumer is connected to the online account from an IP address or online location from which the entity knows the consumer customarily accesses the account.
- Consumer Reporting Agency Obligations: If more than 1,000 residents are notified, the entity must notify all nationwide credit reporting agencies without unreasonable delay as to the timing, distribution, and content of consumer notices.