Ready to Edit

New Jersey Data Protection Impact Assessment - Free Editor

NEW JERSEY DATA PROTECTION IMPACT ASSESSMENT (DPIA)

Prepared Pursuant to the New Jersey Data Privacy Act (NJDPA), N.J. Stat. § 56:8-166 et seq.

COVER PAGE

Field	Details
Organization Name	[________________________________]
Organization Address	[________________________________]
Assessment Title	[________________________________]
Assessment Reference Number	DPIA-NJ-[____]-[________________________________]
Version Number	[____]
Assessment Date	[__/__/____]
Processing Activity Described	[________________________________]
Business Unit / Department	[________________________________]
Assessment Prepared By	[________________________________]
Title / Role	[________________________________]
Data Protection Officer (DPO)	[________________________________]
Chief Information Security Officer	[________________________________]
Legal Counsel Reviewer	[________________________________]
Executive Approver	[________________________________]
Approval Date	[__/__/____]
Next Scheduled Review Date	[__/__/____]

Document Classification

☐ Confidential — Attorney-Client Privileged
☐ Confidential — Internal Use Only
☐ Restricted Distribution
☐ Other: [________________________________]

NJDPA Privilege Note: Data protection assessments disclosed to the New Jersey Division of Consumer Affairs or the Attorney General's office are confidential and exempt from public inspection, copying, or disclosure. Disclosure does not constitute a waiver of attorney-client privilege or work-product protection that might otherwise apply.

EXECUTIVE SUMMARY

Overview of Processing Activity

[________________________________]

Provide a concise description of the data processing activity under assessment, including its business purpose, the categories of consumers affected, and the nature of personal data involved.

Overall Risk Level

☐ Low Risk — Processing activity presents minimal risk to consumer rights
☐ Moderate Risk — Processing activity presents some risk requiring standard mitigation
☐ High Risk — Processing activity presents heightened risk requiring enhanced safeguards
☐ Critical Risk — Processing activity presents severe risk; recommend cessation or fundamental redesign

Summary of Key Findings

[________________________________]

Recommendation

☐ Approve processing activity as described with current safeguards
☐ Approve processing activity subject to implementation of recommended mitigation measures
☐ Defer approval pending further analysis or consultation
☐ Do not approve — risks outweigh benefits

NJDPA DPIA Trigger Assessment

This DPIA is required because the processing activity involves one or more of the following heightened-risk activities under the NJDPA:

☐ Processing of personal data for purposes of targeted advertising
☐ Sale of personal data
☐ Processing of personal data for purposes of profiling, where profiling presents a reasonably foreseeable risk of:
☐ Unfair or deceptive treatment of, or unlawful disparate impact on, consumers
☐ Financial, physical, or reputational injury to consumers
☐ An intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers where such intrusion would be offensive to a reasonable person
☐ Processing of sensitive data
☐ Any other processing activity presenting a heightened risk of harm to consumers

SECTION 1: PROCESSING ACTIVITY DESCRIPTION

1.1 Nature of Processing

What personal data is being processed?

Data Category	Description	Example Data Elements
Contact Information	[________________________________]	[________________________________]
Identity Data	[________________________________]	[________________________________]
Financial Data	[________________________________]	[________________________________]
Location Data	[________________________________]	[________________________________]
Biometric Data	[________________________________]	[________________________________]
Health Data	[________________________________]	[________________________________]
Online Activity / Browsing Data	[________________________________]	[________________________________]
Employment Data	[________________________________]	[________________________________]
Education Data	[________________________________]	[________________________________]
Inferences and Profiles	[________________________________]	[________________________________]
Other	[________________________________]	[________________________________]

1.2 Whose Data Is Processed?

☐ New Jersey consumers (residents)
☐ Employees / job applicants
☐ Customers / clients
☐ Website visitors / app users
☐ Vendors / contractors
☐ Minors (under 13)
☐ Minors (13-17)
☐ Other: [________________________________]

Estimated number of NJ data subjects affected: [________________________________]

1.3 Purpose of Processing

Purpose	Description	Legal Justification
[________________________________]	[________________________________]	[________________________________]
[________________________________]	[________________________________]	[________________________________]
[________________________________]	[________________________________]	[________________________________]

1.4 How Is Data Processed?

☐ Collection (direct from consumer)
☐ Collection (from third-party sources)
☐ Storage (electronic)
☐ Storage (physical records)
☐ Organization / structuring
☐ Analysis / profiling
☐ Automated decision-making
☐ Targeted advertising
☐ Sale to third parties
☐ Sharing with service providers / processors
☐ Cross-border or interstate transfer
☐ Deletion / destruction
☐ Other: [________________________________]

1.5 Retention Period

Data Category	Retention Period	Justification	Deletion Method
[________________________________]	[________________________________]	[________________________________]	[________________________________]
[________________________________]	[________________________________]	[________________________________]	[________________________________]

1.6 Data Storage Locations

System / Platform	Location (State/Country)	Cloud / On-Premise	Encryption Status
[________________________________]	[________________________________]	[________________________________]	[________________________________]
[________________________________]	[________________________________]	[________________________________]	[________________________________]

SECTION 2: LEGAL BASIS AND NECESSITY

2.1 Lawful Basis for Processing Under NJDPA

The NJDPA requires controllers to limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed. The controller must provide a reasonably accessible, clear, and meaningful privacy notice.

Primary legal justification for this processing activity:

☐ Consumer consent (opt-in) — required for sensitive data
☐ Performance of a contract or provision of a requested product/service
☐ Compliance with federal or state legal obligation
☐ Legitimate business purpose within the reasonable expectations of the consumer
☐ Protection of vital interests
☐ Internal operations reasonably aligned with the consumer's expectations based on the consumer's existing relationship with the controller
☐ Other: [________________________________]

2.2 Purpose Limitation Assessment

Is processing limited to purposes disclosed in the privacy notice? ☐ Yes ☐ No
Are there secondary uses of the data not disclosed to consumers? ☐ Yes ☐ No
If secondary uses exist, have consumers been notified and/or consent obtained? ☐ Yes ☐ No ☐ N/A
Is processing compatible with the context in which data was originally collected? ☐ Yes ☐ No

2.3 Data Minimization Assessment

Is only the minimum necessary personal data collected? ☐ Yes ☐ No
Could the processing purpose be achieved with less data? ☐ Yes ☐ No
Could the processing purpose be achieved with de-identified data? ☐ Yes ☐ No
Could the processing purpose be achieved with aggregated data? ☐ Yes ☐ No
Has a formal data minimization review been conducted? ☐ Yes ☐ No

2.4 NJ-Specific Legal Requirements

NJDPA Applicability Thresholds:
- Does the organization control or process personal data of 100,000 or more NJ consumers (excluding data processed solely for completing payment transactions)? ☐ Yes ☐ No
- Does the organization control or process personal data of 25,000 or more NJ consumers AND derive revenue or receive a discount on the price of goods or services from the sale of personal data? ☐ Yes ☐ No
- Note: There is no revenue minimum. The NJDPA applies to nonprofit organizations (unlike most other state privacy laws).

NJDPA Exemptions:
☐ Organization is exempt as a financial institution subject to GLBA (Title V) — exemption applies to activities, not the entity
☐ Organization is exempt as a covered entity or business associate under HIPAA — exemption applies to PHI only
☐ Organization is exempt as a government entity
☐ Data is exempt: data processed under FCRA, DPPA, FERPA, or Farm Credit Act
☐ Data is exempt: employment data processed in the employment context
☐ None — NJDPA applies in full

Important: The NJDPA does NOT exempt higher education institutions or nonprofits.

SECTION 3: DATA INVENTORY

3.1 Categories of Personal Data

Category	Collected?	Source	Recipients	Retention
Name / Contact Information	☐ Yes ☐ No	[________________________________]	[________________________________]	[________________________________]
Government Identifiers (SSN, DL)	☐ Yes ☐ No	[________________________________]	[________________________________]	[________________________________]
Financial / Payment Data	☐ Yes ☐ No	[________________________________]	[________________________________]	[________________________________]
Precise Geolocation Data	☐ Yes ☐ No	[________________________________]	[________________________________]	[________________________________]
Biometric Data	☐ Yes ☐ No	[________________________________]	[________________________________]	[________________________________]
Health / Medical Data	☐ Yes ☐ No	[________________________________]	[________________________________]	[________________________________]
Online Identifiers / Browsing Data	☐ Yes ☐ No	[________________________________]	[________________________________]	[________________________________]
Inferences / Consumer Profiles	☐ Yes ☐ No	[________________________________]	[________________________________]	[________________________________]

3.2 Sensitive Data Under NJDPA

The NJDPA defines the following categories of sensitive data requiring opt-in consent before processing:

Sensitive Data Category	Processed?	Consent Obtained?	Method of Consent
Racial or ethnic origin	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]
Religious beliefs	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]
Mental or physical health condition or diagnosis	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]
Sexual orientation	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]
Citizenship or immigration status	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]
Genetic data	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]
Biometric data used for identification	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]
Personal data of a known child under age 13	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]
Precise geolocation data	☐ Yes ☐ No	☐ Yes ☐ No ☐ N/A	[________________________________]

3.3 Data Sources

Source	Type	Consent / Notice Provided?
[________________________________]	☐ Direct from consumer ☐ Third party ☐ Public source	☐ Yes ☐ No
[________________________________]	☐ Direct from consumer ☐ Third party ☐ Public source	☐ Yes ☐ No

3.4 Data Recipients and Sharing

Recipient	Relationship	Purpose	DPA in Place?
[________________________________]	☐ Processor ☐ Controller ☐ Third Party	[________________________________]	☐ Yes ☐ No
[________________________________]	☐ Processor ☐ Controller ☐ Third Party	[________________________________]	☐ Yes ☐ No

3.5 Cross-Border and Interstate Transfers

Destination	Transfer Mechanism	Safeguards
[________________________________]	[________________________________]	[________________________________]

SECTION 4: STAKEHOLDER CONSULTATION

4.1 Data Subject Consultation

Consultation Method	Date	Summary of Input	Changes Made
[________________________________]	[__/__/____]	[________________________________]	[________________________________]

Were consumers or their representatives consulted? ☐ Yes ☐ No
If no, explain why consultation was not feasible: [________________________________]

4.2 Data Protection Officer (DPO) Input

DPO Name	Date Consulted	Recommendations
[________________________________]	[__/__/____]	[________________________________]

4.3 Business Stakeholder Input

Stakeholder Name / Role	Date Consulted	Input Provided
[________________________________]	[__/__/____]	[________________________________]
[________________________________]	[__/__/____]	[________________________________]

4.4 Legal Counsel Review

Attorney Name	Firm / In-House	Date Reviewed	Advice Summary
[________________________________]	[________________________________]	[__/__/____]	[________________________________]

SECTION 5: NECESSITY AND PROPORTIONALITY

5.1 Necessity Assessment

The NJDPA requires that data protection assessments identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards the controller can employ.

Is the processing necessary for the stated purpose?
☐ Yes — processing is essential and cannot reasonably be achieved otherwise
☐ Partially — some aspects of processing could be reduced or eliminated
☐ No — less intrusive alternatives exist that would achieve the stated purpose

Explanation: [________________________________]

5.2 Less Intrusive Alternatives

Alternative Considered	Why Rejected or Adopted	Data Impact
[________________________________]	[________________________________]	[________________________________]
[________________________________]	[________________________________]	[________________________________]

5.3 Benefits vs. Risks Weighing

Benefits to Controller:
[________________________________]

Benefits to Consumer:
[________________________________]

Benefits to Other Stakeholders / Public:
[________________________________]

Risks to Consumer Rights:
[________________________________]

Safeguards Employed to Reduce Risks:
[________________________________]

5.4 Proportionality Factors

Use of de-identified data: ☐ Evaluated ☐ Not Evaluated
Reasonable expectations of consumers given context: ☐ Evaluated ☐ Not Evaluated
Relationship between controller and consumer: ☐ Evaluated ☐ Not Evaluated
Whether processing involves minors: ☐ Evaluated ☐ Not Evaluated
Whether processing involves sensitive data: ☐ Evaluated ☐ Not Evaluated

SECTION 6: RISK ASSESSMENT

6.1 Risk Likelihood and Severity Matrix

Likelihood / Severity	Negligible	Limited	Significant	Severe
Remote	Low	Low	Moderate	Moderate
Unlikely	Low	Moderate	Moderate	High
Possible	Moderate	Moderate	High	High
Likely	Moderate	High	High	Critical
Almost Certain	High	High	Critical	Critical

6.2 Identified Risks to Data Subjects

Risk ID	Risk Description	Likelihood	Severity	Risk Score	Affected Rights
R-001	Unauthorized access to personal data	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Confidentiality
R-002	Unfair or deceptive treatment through profiling	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Non-discrimination
R-003	Unlawful disparate impact on consumers	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Equal treatment
R-004	Financial injury to consumers	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Financial security
R-005	Physical injury to consumers	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Physical safety
R-006	Reputational harm to consumers	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Reputation / dignity
R-007	Intrusion upon solitude or seclusion	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Privacy / seclusion
R-008	Loss of confidentiality of sensitive data	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Sensitive data privacy
R-009	Re-identification of de-identified data	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	Anonymity
R-010	[________________________________]	☐ Remote ☐ Unlikely ☐ Possible ☐ Likely ☐ Almost Certain	☐ Negligible ☐ Limited ☐ Significant ☐ Severe	[____]	[________________________________]

6.3 Overall Risk Rating

☐ Low ☐ Moderate ☐ High ☐ Critical

Justification: [________________________________]

SECTION 7: RISK MITIGATION MEASURES

7.1 Technical Measures

Measure	Status	Owner	Target Date
Encryption at rest (AES-256 or equivalent)	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Encryption in transit (TLS 1.2+)	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Role-based access controls (RBAC)	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Multi-factor authentication (MFA)	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Pseudonymization / tokenization	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Audit logging and monitoring	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Data loss prevention (DLP)	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Network segmentation / firewall	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Vulnerability scanning / penetration testing	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Automated data retention enforcement	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Intrusion detection / prevention systems	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Backup and disaster recovery	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]

7.2 Organizational Measures

Measure	Status	Owner	Target Date
Privacy and data protection training	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Written information security policies	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Incident response plan (NJ-specific)	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Privacy-by-design and default practices	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Consumer rights request procedures	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Data mapping and inventory	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Periodic access reviews	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Background checks for privileged users	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]

7.3 Contractual Measures

Measure	Status	Owner	Target Date
Data processing agreements (DPAs)	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Vendor security assessment program	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Data sharing agreements	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Subprocessor restrictions	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Breach notification clauses	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]
Data deletion / return provisions	☐ Implemented ☐ Planned ☐ N/A	[________________________________]	[__/__/____]

7.4 Residual Risk After Mitigation

Risk ID	Original Score	Mitigation Applied	Residual Score	Acceptable?
R-001	[____]	[________________________________]	[____]	☐ Yes ☐ No
R-002	[____]	[________________________________]	[____]	☐ Yes ☐ No
R-003	[____]	[________________________________]	[____]	☐ Yes ☐ No
R-004	[____]	[________________________________]	[____]	☐ Yes ☐ No
R-005	[____]	[________________________________]	[____]	☐ Yes ☐ No

SECTION 8: NEW JERSEY-SPECIFIC COMPLIANCE CHECKLIST

8.1 NJDPA Consumer Rights Compliance

Requirement	Status	Notes
Right to confirm whether data is being processed	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Right to access personal data	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Right to correct inaccuracies	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Right to delete personal data	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Right to data portability (machine-readable format)	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Right to opt out of sale of personal data	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Right to opt out of targeted advertising	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Right to opt out of profiling with significant effects	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Response within 45 days (+ extension if needed)	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Appeal mechanism for denied requests	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Non-discrimination for exercising rights	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]

8.2 Universal Opt-Out Mechanism (Effective July 15, 2025)

CRITICAL: The NJDPA requires recognition of universal opt-out mechanisms (such as Global Privacy Control) as of July 15, 2025.

☐ Universal opt-out mechanism recognized and honored (GPC, etc.)
☐ Technical implementation verified
☐ No requirement for consumer to submit separate request when universal signal detected
☐ Documentation of opt-out signal processing

8.3 Cure Period Status

NJDPA Cure Period Timeline:
- January 15, 2025 — July 15, 2026: 18-month cure period available
- After July 16, 2026: Cure period expires; AG has discretion to offer cure

☐ Organization is aware of cure period sunset date (July 16, 2026)
☐ Compliance remediation processes are in place to address violations within cure period
☐ Organization is prepared for post-cure enforcement environment

8.4 Privacy Notice Requirements

Requirement	Status	Notes
Reasonably accessible, clear, and meaningful privacy notice	☐ Compliant ☐ In Progress ☐ Non-Compliant	[________________________________]
Categories of personal data processed	☐ Disclosed ☐ Not Disclosed	[________________________________]
Purpose of processing	☐ Disclosed ☐ Not Disclosed	[________________________________]
Consumer rights and how to exercise them	☐ Disclosed ☐ Not Disclosed	[________________________________]
Categories of third parties with whom data is shared	☐ Disclosed ☐ Not Disclosed	[________________________________]
Whether data is sold or used for targeted advertising	☐ Disclosed ☐ Not Disclosed	[________________________________]
Appeal process	☐ Disclosed ☐ Not Disclosed	[________________________________]

8.5 Breach Notification Requirements (N.J. Stat. § 56:8-163)

Requirement	Status	Notes
Breach detection and investigation procedures	☐ In Place ☐ In Progress ☐ Not In Place	[________________________________]
Report to NJ State Police before consumer notice	☐ Documented ☐ Not Documented	[________________________________]
Consumer notification in "most expedient time without unreasonable delay"	☐ Documented ☐ Not Documented	[________________________________]
Consumer reporting agency notification (if 1,000+ affected)	☐ Documented ☐ Not Documented	[________________________________]
Written determination retained 5 years if no notice required (no reasonable misuse)	☐ Documented ☐ Not Documented	[________________________________]
PI definition: name + SSN, DL, account number, medical information	☐ Reviewed ☐ Not Reviewed	[________________________________]

8.6 Penalties Under NJDPA

$10,000 per first violation
$20,000 per subsequent violation
AG/Division of Consumer Affairs has exclusive enforcement authority
No private right of action under the NJDPA
Violations may also constitute unfair practices under the Consumer Fraud Act (N.J. Stat. § 56:8-1 et seq.)

SECTION 9: THIRD-PARTY AND VENDOR ASSESSMENT

9.1 Sub-Processors

Sub-Processor Name	Services Provided	Data Accessed	DPA Executed?	Security Assessment Date
[________________________________]	[________________________________]	[________________________________]	☐ Yes ☐ No	[__/__/____]
[________________________________]	[________________________________]	[________________________________]	☐ Yes ☐ No	[__/__/____]

9.2 Processor Contract Requirements Under NJDPA

For each processor, verify the following contractual provisions:

☐ Clear instructions for processing personal data
☐ Nature and purpose of processing
☐ Type of data subject to processing
☐ Duration of processing
☐ Rights and obligations of both parties
☐ Confidentiality obligations
☐ Requirement to delete or return personal data at end of service
☐ Obligation to make available all information to demonstrate compliance
☐ Subprocessor engagement restrictions and notification obligations
☐ Assistance with consumer rights requests

9.3 Vendor Security Assessment

For each vendor processing NJ consumer personal data:

☐ SOC 2 Type II report reviewed (or equivalent certification)
☐ Encryption standards meet or exceed requirements
☐ Access controls verified
☐ Incident response capabilities confirmed
☐ Data deletion / return procedures documented
☐ Subprocessor restrictions documented
☐ Insurance coverage verified
☐ NJ-specific breach notification cooperation clause included

SECTION 10: AUTOMATED DECISION-MAKING AND PROFILING

10.1 Profiling Activities

Does this processing involve profiling? ☐ Yes ☐ No

NJDPA Profiling Definition: Any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

Profiling Activity	Purpose	Data Used	Opt-Out Available?
[________________________________]	[________________________________]	[________________________________]	☐ Yes ☐ No

10.2 Heightened Risk Profiling Assessment

Under the NJDPA, profiling presents heightened risk when it creates a reasonably foreseeable risk of:

☐ Unfair or deceptive treatment of consumers
☐ Unlawful disparate impact on consumers
☐ Financial, physical, or reputational injury to consumers
☐ Physical or other intrusion upon the solitude or seclusion of consumers

Assessment of whether this profiling activity meets heightened-risk threshold:
[________________________________]

10.3 Automated Decision-Making

Are decisions made solely through automated means with legal or similarly significant effects? ☐ Yes ☐ No
If yes, describe the decision-making logic: [________________________________]
Human review / override mechanism: [________________________________]
Has the algorithm been tested for bias? ☐ Yes ☐ No
Has the algorithm been tested for accuracy? ☐ Yes ☐ No

SECTION 11: CHILDREN'S DATA

11.1 COPPA and NJDPA Children's Data Requirements

Under the NJDPA, personal data of a known child under the age of 13 is classified as sensitive data requiring opt-in consent.

Does this processing involve data of individuals known to be under 13? ☐ Yes ☐ No
If yes, is verifiable parental consent obtained per COPPA (15 U.S.C. § 6501 et seq.)? ☐ Yes ☐ No ☐ N/A
Does the organization have a COPPA-compliant privacy policy? ☐ Yes ☐ No
Are age-gating mechanisms in place? ☐ Yes ☐ No
Is data of minors aged 13-17 processed? ☐ Yes ☐ No
If yes, describe additional protections: [________________________________]

11.2 Children's Data Safeguards

Safeguard	Status
Age verification mechanism	☐ Implemented ☐ Planned ☐ N/A
Parental consent workflow (COPPA)	☐ Implemented ☐ Planned ☐ N/A
Restricted data collection for children	☐ Implemented ☐ Planned ☐ N/A
No targeted advertising to known children	☐ Implemented ☐ Planned ☐ N/A
No sale of known children's data	☐ Implemented ☐ Planned ☐ N/A
Expedited deletion upon parental request	☐ Implemented ☐ Planned ☐ N/A

SECTION 12: MONITORING AND REVIEW

12.1 Review Schedule

Review Type	Frequency	Next Review Date	Responsible Party
Full DPIA reassessment	☐ Annual ☐ Biannual ☐ Other: [____]	[__/__/____]	[________________________________]
Processing activity review	☐ Quarterly ☐ Semi-annual ☐ Annual	[__/__/____]	[________________________________]
Risk mitigation effectiveness	☐ Quarterly ☐ Semi-annual ☐ Annual	[__/__/____]	[________________________________]
Vendor / third-party review	☐ Annual ☐ Biannual ☐ Other: [____]	[__/__/____]	[________________________________]
NJ regulatory landscape review	☐ Quarterly ☐ Semi-annual ☐ Annual	[__/__/____]	[________________________________]

12.2 Trigger Events for Reassessment

☐ Material change in the processing activity
☐ New categories of personal data collected
☐ New categories of data subjects
☐ Change in purpose of processing
☐ New sub-processor or third-party data recipient
☐ Geographic expansion (new jurisdictions)
☐ Security incident or data breach
☐ Regulatory inquiry from NJ AG or Division of Consumer Affairs
☐ Legislative amendment to the NJDPA
☐ Final regulations published by the Division of Consumer Affairs
☐ Consumer complaints related to this processing activity
☐ Organizational changes (M&A, restructuring)
☐ Significant change in data volume (increase > 25%)
☐ Cure period expiration (July 16, 2026)

12.3 Version Control

Version	Date	Author	Summary of Changes
[____]	[__/__/____]	[________________________________]	[________________________________]
[____]	[__/__/____]	[________________________________]	[________________________________]

SECTION 13: APPROVAL AND SIGN-OFF

Data Protection Officer / Privacy Lead


Name	[________________________________]
Title	[________________________________]
Signature	[________________________________]
Date	[__/__/____]
Recommendation	☐ Approve ☐ Approve with Conditions ☐ Reject
Comments	[________________________________]

Chief Information Security Officer (CISO)


Name	[________________________________]
Title	[________________________________]
Signature	[________________________________]
Date	[__/__/____]
Recommendation	☐ Approve ☐ Approve with Conditions ☐ Reject
Comments	[________________________________]

Legal Counsel


Name	[________________________________]
Title	[________________________________]
Firm (if external)	[________________________________]
Signature	[________________________________]
Date	[__/__/____]
Recommendation	☐ Approve ☐ Approve with Conditions ☐ Reject
Comments	[________________________________]

Business Owner / Executive Approver


Name	[________________________________]
Title	[________________________________]
Signature	[________________________________]
Date	[__/__/____]
Decision	☐ Approved ☐ Approved with Conditions ☐ Rejected ☐ Deferred
Conditions (if applicable)	[________________________________]

APPENDIX A: DATA FLOW DIAGRAM

[Data Subject] ---> [Collection Point] ---> [Primary Storage]
|
[Processing System]
|
+---------------+---------------+
| | |
[Analytics] [Third Party] [Backup/DR]
| | |
[Reporting] [Sub-Processor] [Archive]
Instructions: Replace the above placeholder with an actual data flow diagram specific to the processing activity. The diagram must show all collection points, storage systems, processors, sub-processors, third-party recipients, and data lifecycle endpoints.

APPENDIX B: RISK MATRIX TEMPLATE

	Negligible Impact	Limited Impact	Significant Impact	Severe Impact
Almost Certain	High	High	Critical	Critical
Likely	Moderate	High	High	Critical
Possible	Moderate	Moderate	High	High
Unlikely	Low	Moderate	Moderate	High
Remote	Low	Low	Moderate	Moderate

Scoring Guide:
- Critical (16-25): Immediate escalation; processing must not proceed without executive approval
- High (10-15): Senior management review required; implement additional mitigations
- Moderate (5-9): Standard mitigation measures; document and monitor
- Low (1-4): Acceptable risk; routine monitoring

APPENDIX C: GLOSSARY OF TERMS

Term	Definition
Consumer	A natural person who is a NJ resident acting only in an individual or household context; excludes persons acting in a commercial or employment context (NJDPA)
Controller	A natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data (NJDPA)
Processor	A natural or legal entity that processes personal data on behalf of a controller (NJDPA)
Personal Data	Any information that is linked or reasonably linkable to an identified or identifiable natural person; excludes de-identified data and publicly available information (NJDPA)
Sensitive Data	Categories requiring opt-in consent: racial/ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship/immigration, genetic data, biometric data, children under 13, precise geolocation (NJDPA)
Sale	Exchange of personal data for monetary or other valuable consideration by the controller to a third party (NJDPA)
Targeted Advertising	Displaying advertisements to a consumer based on personal data obtained from the consumer's activities across nonaffiliated websites or online applications to predict preferences or interests (NJDPA)
Profiling	Any form of automated processing to evaluate, analyze, or predict personal aspects of an identified or identifiable individual (NJDPA)
Universal Opt-Out Mechanism	A browser or device setting, technology, or other mechanism that sends a signal indicating the consumer's intent to opt out of the processing of personal data for targeted advertising or sale (NJDPA)

NEW JERSEY-SPECIFIC COMPLIANCE NOTES

Unique NJDPA Features

Nonprofit Applicability: Unlike most state privacy laws, the NJDPA applies to nonprofit organizations, making it one of the broadest in scope among US state privacy laws.
Universal Opt-Out Requirement (July 15, 2025): Controllers must recognize and honor universal opt-out mechanisms such as Global Privacy Control (GPC). This requirement took effect six months after the law's effective date.
18-Month Cure Period: The NJDPA provides an 18-month cure period from its effective date (January 15, 2025 through July 15, 2026). After July 16, 2026, cure is at the discretion of the Division of Consumer Affairs.
Draft Regulations Expected: The Division of Consumer Affairs was authorized to issue draft regulations beginning June 2, 2025, with final regulations expected in 2026. These regulations will provide detailed guidance on DPIA requirements, consumer rights request processes, and opt-out mechanisms.
NJ State Police Notification First: Under the breach notification statute (N.J. Stat. § 56:8-163), entities must report breaches to the NJ State Police before notifying affected consumers, a unique requirement among US states.
Broad Definition of Personal Information for Breach: New Jersey's breach notification law covers a broad range of data elements including medical information and health insurance information in addition to traditional categories.
DPIA Confidentiality: Data protection assessments are confidential and exempt from public inspection, and disclosure to the AG does not waive privilege protections.
Heightened Penalty Structure: The NJDPA imposes $10,000 for first violations and $20,000 for subsequent violations, with no cap on total penalties, creating significant financial exposure for organizations with widespread non-compliance.

SOURCES AND REFERENCES

New Jersey Data Privacy Act (NJDPA), S332, codified at N.J. Stat. § 56:8-166 et seq. — https://www.njleg.state.nj.us/bill-search/2022/S332/bill-text?f=S0500&n=332_R6
N.J. Stat. § 56:8-163, Security Breach Notification — https://www.njleg.state.nj.us
NJ Cyber.gov, "New Jersey Enacts Comprehensive Data Privacy Law" — https://www.cyber.nj.gov/guidance-and-best-practices/identity-theft-privacy/data-privacy/nj-data-privacy-prevention-act
White & Case, "New Jersey Enacts Comprehensive Data Privacy Law" — https://www.whitecase.com/insight-alert/new-jersey-enacts-comprehensive-data-privacy-law
SecurePrivacy, "New Jersey Data Privacy Act (S332) Complete Guide for 2025" — https://secureprivacy.ai/blog/new-jersey-s332-privacy-bill-guide
BigID, "NJ Data Privacy Legislation SB 332" — https://bigid.com/blog/nj-sb-332-data-privacy-legislation/
Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.
IAPP, US State Privacy Legislation Tracker — https://iapp.org/resources/article/us-state-privacy-legislation-tracker
Centraleyes, "New Jersey Privacy Act 2025: What to Expect" — https://www.centraleyes.com/new-jersey-privacy-act/