New Jersey's data breach notification law, in plain words

By New Jersey IT Solutions Team · Published 2026-10-02 · Updated 2026-10-15

Nobody plans to read a breach law on the day of a breach. Read it now, while things are calm.

This page explains the main points of N.J.S.A. 56:8-163 in plain words. It is not legal advice. Law changes, so check the current text and ask a New Jersey lawyer about your case.

Where does this come from?

The rules sit in the New Jersey Identity Theft Prevention Act. The law was amended by P.L. 2019, c. 95, approved May 10, 2019. We read the bill text on the New Jersey Legislature's site: P.L. 2019, c. 95 (S52). The section that tells businesses what to do after a breach is 56:8-163. The definitions are in 56:8-161.

What counts as a breach?

The law defines a breach of security as unauthorized access to electronic files, media or data containing personal information when that information was not secured by encryption.

Encryption matters. Scrambled data that attackers cannot read is treated differently from data they can read.

What counts as personal information?

A person's first name or first initial and last name, together with one or more of these:

• Social Security number.
• Driver's license or state ID number.
• Account number or credit or debit card number, with the code or password that would let someone use it.
• A user name or email address with a password or security question and answer that would open an online account. This item was added in the 2019 amendment.

What must you do, in order?

1. Find out what happened. Work out whether New Jersey residents' personal information was accessed.
2. Report to the Division of State Police first. The statute says you must report the breach and related information to the Division of State Police before you tell the customer.
3. Watch for a law enforcement delay. If a law enforcement agency says telling customers would impede an investigation, the notice is delayed until the agency says it will not.
4. Tell affected customers in the most expedient time possible and without unreasonable delay.
5. If more than 1,000 people must be told, also tell all consumer reporting agencies that compile files on consumers on a nationwide basis, without unreasonable delay.

What if you decide the data was not misused?

The statute says you do not have to disclose if you establish that misuse of the information is not reasonably possible. The law also says that determination must be written down and kept for five years. If you ever rely on this, write it down at the time, with your reasons.

What can you do before a breach?

• Encrypt laptops and phones that hold personal data.
• Turn on MFA for email and cloud apps. See the FTC's cybersecurity basics.
• Keep a list of where personal data lives.
• Write a one-page plan with the names and numbers of who to call.
• Know who your lawyer and insurer are.

New Jersey also has a privacy law, separate from this one. Read our NJ Data Privacy Act guide and try the free privacy self-check.

Do I need a lawyer for a data breach in New Jersey?

Often yes, at least for a short talk. The law has details, such as delays when police ask, and special cases for some data. This page is a plain-words guide, not legal advice. If you may have had a breach, call your IT partner and a New Jersey lawyer early.

A short breach-ready plan to write now

1. Know where personal data lives. Customer files, payroll, email and cloud tools.
2. Know who to call. IT partner, lawyer, insurer. Put the numbers on one page.
3. Protect the data. MFA, updates, backups and encryption where you can.
4. Keep notes. Write down what happened and when, as it happens.
5. Practice once. Ten minutes at a staff meeting is enough.

Why encryption helps

The law's breach definition covers data that was not secured by encryption. Encrypting laptops and phones that hold personal data can keep a lost device from turning into a legal event. Ask your IT provider whether yours are encrypted. Our backup guide and ransomware checklist pair well with this plan.

How we can help

We help New Jersey businesses find where personal data lives, close the common gaps, and write a breach plan. Book a free 30-minute review and we will tell you what we would fix first.

Common questions

Who must be told first in a New Jersey data breach?

The Division of State Police in the Department of Law and Public Safety, before the customers are told. The statute then allows a delay if law enforcement says notice would impede an investigation.

Does the New Jersey law apply to small businesses?

The statute covers businesses that do business in New Jersey and keep computerized records with personal information. It does not carve out small businesses in the text we reviewed.

What counts as personal information under the law?

A first name or first initial and last name together with a Social Security number, a driver's license or state ID number, an account or card number with the code that allows access, or a user name or email with a password or security answer that would open an online account.

Is there a fixed number of days to notify?

The text we reviewed says notice must be made in the most expedient time possible and without unreasonable delay. It does not set a number of days. Ask a lawyer about your situation.

Do I need a lawyer for a New Jersey data breach?

Often at least a short talk helps, because the law has details. This page is a plain guide, not legal advice.