Skip to content
Network USA

NJ · Breach notification statute

New Jersey data breach notification law

A summary of the New Jersey breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

N.J. Stat. Ann. §§ 56:8-161 to 56:8-166 (Identity Theft Prevention Act (Data Breach Notification Provisions)) (amended 2019)

Last amended
2019 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Most expedient time possible and without unreasonable delay New Jersey requires businesses to notify

Attorney general notice

Yes New Jersey requires notification to the Division of State Police before disclosing to customers for all

What counts as a breach

In New Jersey 'breach of security' means unauthorized access to electronic files, media or data containing personal information that compromises the security, confidentiality or integrity of personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. Good faith acquisition of personal information by an employee or agent of the business for a legitimate business p

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in New Jersey

177 reports to HHS OCR affecting 79,985,058 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in New Jersey.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Conduent Business Services LLCBusiness Associate62,224,658Oct 8, 2025Hacking/IT IncidentUnder investigation
HealthEC LLCBusiness Associate4,786,241Dec 21, 2023Hacking/IT IncidentArchive (closed)
CareCloud, Inc.Business Associate3,756,469Jul 24, 2026Hacking/IT IncidentUnder investigation
GRM Information Management ServicesBusiness Associate1,700,000Feb 11, 2011TheftArchive (closed)
Horizon Healthcare Services, Inc., doing business as Horizon Blue Cross Blue Shield of New Jersey, and its affiliatesBusiness Associate839,711Jan 3, 2014TheftArchive (closed)

Frequently asked questions

When must New Jersey businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the New Jersey timing rule as: "Most expedient time possible and without unreasonable delay New Jersey requires businesses to notify". (Source: PRC 2026 survey extract.)

Does New Jersey require notice to the attorney general?

The PRC 2026 extract notes: "Yes New Jersey requires notification to the Division of State Police before disclosing to customers for all". (Source: PRC 2026 survey extract.)

Does the New Jersey law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the New Jersey breach law.

Does the New Jersey law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the New Jersey breach law.

Does the New Jersey law cover paper records?

No. The PRC 2026 survey records the New Jersey law as covering computerised data only, not paper records.

Is there a private right of action in New Jersey?

Yes. The PRC 2026 survey records a private right of action under the New Jersey breach law.

Is credit monitoring required in New Jersey?

No. The PRC 2026 survey does not record a credit monitoring requirement in New Jersey.

How does the New Jersey law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the New Jersey statute, and see our HIPAA vs state breach notification laws guide.

Sources