NEW JERSEY DATA BREACH NOTIFICATION LETTER
(Agency & Consumer Templates)
[// GUIDANCE: This document contains two coordinated templates that satisfy New Jersey’s Identity Theft Prevention Act (N.J. Stat. Ann. §§ 56:8-161 et seq.) requirements:
1. “Agency Notification Letter” – for the New Jersey Office of the Attorney General/Division of State Police.
2. “Consumer Notification Letter” – for affected New Jersey residents.
Customize all bracketed fields, maintain identical factual descriptions across versions, and dispatch notices “in the most expedient time possible and without unreasonable delay” after confirming the breach, consistent with any law-enforcement hold.]
TABLE OF CONTENTS
- Agency Notification Letter – New Jersey OAG / Division of State Police
- Consumer Notification Letter – New Jersey Residents
- Appendix A – Key Defined Terms (cross-referenced)
- Appendix B – Optional Credit Monitoring Offer Language
1. AGENCY NOTIFICATION LETTER
(New Jersey Office of the Attorney General & Division of State Police)
Delivered via:
• Certified Mail – Return Receipt Requested
• Encrypted E-mail to: [AGENCY_EMAIL_ADDRESS]
Date: [DATE]
To:
Office of the Attorney General – Division of Law
Data Privacy & Cybersecurity Section
124 Halsey Street, 5th Floor
Newark, New Jersey 07102
Division of State Police – Cyber Crimes Unit
[STREET_ADDRESS]
[City], New Jersey [ZIP]
Re: Notice of Security Breach Pursuant to N.J. Stat. Ann. § 56:8-163
1. Introduction
[COMPANY LEGAL NAME], a [STATE] [corporation/LLC] (“Company”), provides this notice in compliance with N.J. Stat. Ann. § 56:8-163 regarding a breach of security involving Personal Information (defined in Appendix A) maintained on [COMPANY]’s information systems.
2. Incident Description
• Incident Date(s): [INCIDENT_DATE_RANGE]
• Discovery Date: [DISCOVERY_DATE]
• Breach Description: Between the above dates, an unauthorized actor [BRIEF TECHNICAL SUMMARY – e.g., “gained access to an employee e-mail account via phishing”].
• Detection & Containment: [DATE] – [CONTAINMENT_MEASURES].
• Scope: [NUMBER] New Jersey residents’ records were impacted.
3. Categories of Personal Information Affected
Check all that apply (N.J. Stat. Ann. § 56:8-161):
☐ Social Security Number
☐ Driver’s License / State ID Number
☐ Financial Account / Credit-Debit Card Number (+ any required access code)
☐ [OTHER PI CATEGORY]
4. Law-Enforcement Coordination
On [DATE], Company contacted [LAW-ENFORCEMENT AGENCY] and was informed that disclosure to affected individuals is / is not deferred.
5. Consumer Notice & Remediation Plan
• Notification Start Date: [INTENDED_MAILING_DATE] (no later than expediently achievable).
• Method(s): ☐ First-class mail ☐ E-mail ☐ Substitute notice (if applicable).
• Credit Monitoring: Company will offer [12/24] months of complimentary credit monitoring and identity-theft restoration services (details in Appendix B).
• Call Center: Operational from [DATE] at [TOLL-FREE_NUMBER] and at [DEDICATED_EMAIL].
6. Contact Information
Please direct any inquiries to:
[NAME, TITLE]
[COMPANY] – Privacy Office
[STREET_ADDRESS]
[CITY, STATE ZIP]
Tel: [PHONE] E-mail: [EMAIL]
Respectfully submitted,
[AUTHORIZED SIGNATORY NAME]
[TITLE]
[COMPANY LEGAL NAME]
2. CONSUMER NOTIFICATION LETTER
(New Jersey Residents)
Mailed in a separate, sealed envelope marked “IMPORTANT – DATA SECURITY NOTICE”
Date: [DATE]
Notice of Data Breach
Dear [FIRST NAME LAST NAME]:
What Happened?
On [INCIDENT_DATE_RANGE], [COMPANY] experienced a security incident in which an unauthorized party [BRIEF DESCRIPTION]. We discovered the incident on [DISCOVERY_DATE] and took immediate steps to secure our systems.
What Information Was Involved?
Our investigation determined that the personal information listed below relating to you may have been involved:
• [SELECTED CATEGORIES FROM SECTION 3 ABOVE]
We have no evidence that your data has been misused; however, we are notifying you out of an abundance of caution and in compliance with New Jersey law (N.J. Stat. Ann. § 56:8-163).
What We Are Doing
• Secured the affected systems and engaged independent cybersecurity experts.
• Notified the New Jersey Division of State Police.
• Offering you [12/24] months of complimentary credit monitoring and identity-theft restoration services through [SERVICE PROVIDER] (see “Enrollment Instructions” below).
• Enhancing multi-factor authentication and system logging.
What You Can Do
- Carefully review your account statements and credit reports.
- Consider placing a fraud alert or security freeze.
- Enroll in the complimentary credit monitoring service by [ENROLLMENT DEADLINE].
- Remain vigilant and promptly report any suspicious activity.
Complimentary Credit Monitoring – Enrollment Instructions
[DETAILED STEPS OR ACTIVATION CODE]
Resources
- Credit Bureaus
• Equifax – 1-800-685-1111 – www.equifax.com
• Experian – 1-888-397-3742 – www.experian.com
• TransUnion – 1-800-916-8800 – www.transunion.com - Federal Trade Commission – www.identitytheft.gov – 1-877-438-4338
- New Jersey Division of Consumer Affairs – 1-800-242-5846 – www.njconsumeraffairs.gov
For More Information
If you have questions, please contact our dedicated call center at [TOLL-FREE_NUMBER] (Monday-Friday, 9 a.m.–9 p.m. ET) or e-mail us at [DEDICATED_EMAIL].
We regret any inconvenience or concern this incident may cause and remain committed to safeguarding your information.
Sincerely,
[AUTHORIZED SIGNATORY NAME]
[TITLE]
[COMPANY LEGAL NAME]
[COMPANY ADDRESS] | [PHONE] | [EMAIL]
3. APPENDIX A – KEY DEFINED TERMS
- “Breach of Security” – unauthorized access to electronic files, media, or data containing Personal Information that compromises the confidentiality, integrity, or security of such information, as set forth in N.J. Stat. Ann. § 56:8-161.
- “Personal Information” – an individual’s first name or first initial and last name linked with any of the data elements enumerated in N.J. Stat. Ann. § 56:8-161(a) when either the name or the data elements are not encrypted or are encrypted with compromised keys.
- “Company” – [COMPANY LEGAL NAME], its parents, subsidiaries, and affiliates.
- “Incident” – the event described in Section 1.
4. APPENDIX B – OPTIONAL CREDIT MONITORING OFFER LANGUAGE
[Insert vendor-specific enrollment language, term length, coverage description, and disclaimers.]
[// GUIDANCE: If you opt not to provide credit monitoring, delete Appendix B and modify Sections “What We Are Doing” and “Complimentary Credit Monitoring – Enrollment Instructions” accordingly. Note that while NJ law does not expressly mandate credit monitoring, regulators increasingly view it as a best practice.]
FINAL REVIEW CHECKLIST
☐ All bracketed placeholders populated
☐ Incident description identical in both letters
☐ Notification dates comply with “expedient time” standard
☐ Delivery method verified (certified mail / encrypted e-mail)
☐ Law-enforcement consultation documented
☐ Credit-monitoring vendor agreement executed before mailing
[// GUIDANCE: Retain this checklist for the internal file; do not include when mailing notices.]
© [YEAR] [COMPANY LEGAL NAME]. All rights reserved.