View full title
"New Jersey Disclosure and Accountability Transparency Act (NJ DaTA)"; establishes certain requirements for disclosure and processing of personally identifiable information; establishes Office of Data Protection and Responsible Use in Division of Consumer Affairs.
In one paragraph
New Jersey's S2602 would create the New Jersey Disclosure and Accountability Transparency Act (NJ DaTA). Controllers could process personally identifiable information only on a listed basis, such as the consumer's affirmative opt-in consent, and consumers would get disclosure, correction, erasure, objection and automated-decision rights. A violation would be an unlawful practice under the Consumer Fraud Act, and an Office of Data Protection and Responsible Use would be created in the Division of Consumer Affairs. Pre-filed for introduction in the 2026 session.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
Controllers and processors of New Jersey consumers' personal data would need a lawful basis such as opt-in consent, notices, impact assessments and breach reports to the Office.
Key provisions
- Secs. 3-4: data is to be collected and processed only on the consumer's affirmative opt-in; Sec. 4 allows processing only if the consumer opted in or another listed basis applies, such as a contract, a legal obligation or legitimate interests
- Sec. 5: at the time of collection, controllers must give consumers listed information, including the existence of automated decision making and profiling
- Sec. 7: on a verified request, a controller that discloses data to processors or third parties must respond within 30 days with the purposes, categories and recipients; Secs. 8-11 add rectification, erasure, restriction and objection rights
- Sec. 12: a consumer may not be subject to a decision based solely on automated decision making, including profiling, with legal or similarly significant effects, unless needed for a contract, authorized by law with safeguards, or based on explicit consent
- Secs. 18 and 20: breach notice to the Office immediately and, where feasible, within 72 hours; data protection impact assessments submitted to the Office before certain processing
- Sec. 22: creates the Office of Data Protection and Responsible Use; Sec. 23 excludes HIPAA protected health information, Gramm-Leach-Bliley financial institutions, insurance institutions and FCRA-limited consumer reporting data, among others
- Sec. 24: a violation by a controller or processor is an unlawful practice and violation of the Consumer Fraud Act (P.L.1960, c.39)
- Sec. 26: takes effect on the first day of the sixth month after enactment
Latest legislative action
Jan 13, 2026. Introduced in the Senate, Referred to Senate Commerce Committee
Sponsors (showing 5 of 14)
| Name | Role |
|---|---|
| Allen, Diane B. | Primary |
| Cruz-Perez, Nilsa I. | Primary |
| Durr, Edward | Primary |
| Gopal, Vin D | Primary |
| Ruiz, M. Teresa | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error