Data Breach Notice to Residents and State Authorities in New Jersey

At a glance

Requirements one by one

Covered information and the notice decision

Section 56:8-161 defines a breach as unauthorized access to electronic files, media, or data containing personal information whose protection was not secured by encryption or another method making it unreadable or unusable. Its personal information definition includes a name linked with a Social Security number, state ID, financial account credentials, or online-account credentials. It also covers dissociated data when the means to link it were accessed with it. Good-faith employee access for a legitimate business purpose is excluded only if there is no unrelated use or further unauthorized disclosure.

Under § 56:8-163(a), the business may forgo customer disclosure if it establishes that misuse is not reasonably possible. It must document that determination in writing and retain it for five years.

Recipients and timing

Section 56:8-163(a) reaches resident customers whose information was, or is reasonably believed to have been, accessed by an unauthorized person. The business gives notice in the most expedient time possible without unreasonable delay after discovery or notification. Measures to determine the breach scope and restore reasonable system integrity may affect timing. A nonowner record maintainer immediately tells the business or public entity for which it holds the records under subsection (b).

Before customer disclosure, subsection (c)(1) requires a report to the Division of State Police with the breach and any related information. It states no minimum number of affected customers. Under subsection (f), more than 1,000 people requiring notice at one time triggers notice to nationwide consumer reporting agencies without unreasonable delay, with the timing, distribution, and content of customer notices.

Delivery options

Section 56:8-163(d) allows written notice or electronic notice consistent with the federal E-SIGN provision it names. Substitute notice is available when direct notice costs more than $250,000, the affected class exceeds 500,000, or contact information is insufficient. It combines email where addresses are held, a conspicuous website post if the entity maintains a site, and major statewide media.

What trips people up

Credentials alone have their own route. For an online-account credential breach with no other covered information, § 56:8-163(g) permits electronic or other notice directing prompt password or security-answer changes and other account-protection steps. An email-account provider may not use the breached account itself as the notice destination; it must use another permitted method or the specified clear online notice from a customary access location.

A law-enforcement request matters. Under § 56:8-163(c)(2), a delay requires an agency determination that notice would impede a criminal or civil investigation and an agency request. Notice follows when the agency says disclosure will no longer compromise the investigation and informs the entity. A consistent notification policy can satisfy the statute if the entity follows that policy when notifying customers under subsection (e).

Common questions

Is there a five-business-day limit today? Current § 56:8-163(a) says most expedient time possible without unreasonable delay. A3339 proposes the five-business-day limit; it remains in committee.

Must the customer letter include a prescribed list of details? Section 56:8-163 does not prescribe a general list for the customer letter. Its credential-only route has specific account-protection directions, while subsection (c) calls for breach information in the prior State Police report.

Statutes and sources

• N.J. Stat. §§ 56:8-161 and 56:8-163 — definitions and private breach-notice duties. Official New Jersey unannotated statutes, accessed 2026-10-14.