# NJDPA Compliance Assessment Template

## 1. Organization Information

| Field | Value |
|-------|-------|
| Organization name | |
| Business type | |
| NJ consumer data volume | |
| Revenue from data sales | Yes / No |
| Entity exemption claimed | None / HIPAA / GLBA / Nonprofit / Higher Ed / Government |

## 2. Applicability Determination

- [ ] Organization conducts business in NJ or targets NJ residents
- [ ] Processes personal data of >=100,000 NJ consumers (excl. payment-only), OR
- [ ] Processes personal data of >=25,000 NJ consumers AND derives revenue from data sale
- [ ] No entity-level exemption applies

**Determination**: Applicable / Not Applicable
**Rationale**: _______________

## 3. Sensitive Data Inventory

| Sensitive Category | Collected | Processing Purpose | Consent Obtained |
|---|---|---|---|
| Racial/ethnic origin | Yes / No | | Yes / No / N/A |
| Religious beliefs | Yes / No | | Yes / No / N/A |
| Mental/physical health | Yes / No | | Yes / No / N/A |
| Financial information | Yes / No | | Yes / No / N/A |
| Sex life/sexual orientation | Yes / No | | Yes / No / N/A |
| Citizenship/immigration status | Yes / No | | Yes / No / N/A |
| Transgender/non-binary status | Yes / No | | Yes / No / N/A |
| Genetic data | Yes / No | | Yes / No / N/A |
| Biometric data | Yes / No | | Yes / No / N/A |
| Child data (under 13) | Yes / No | | Yes / No / N/A |
| Precise geolocation | Yes / No | | Yes / No / N/A |

## 4. Consumer Rights Readiness

| Right | Mechanism in Place | SLA Tracked | Process Documented |
|-------|-------------------|-------------|-------------------|
| Access | Yes / No | Yes / No | Yes / No |
| Correction | Yes / No | Yes / No | Yes / No |
| Deletion | Yes / No | Yes / No | Yes / No |
| Portability | Yes / No | Yes / No | Yes / No |
| Opt-out of sale | Yes / No | Yes / No | Yes / No |
| Opt-out of targeted advertising | Yes / No | Yes / No | Yes / No |
| Opt-out of profiling | Yes / No | Yes / No | Yes / No |
| Appeal process | Yes / No | Yes / No | Yes / No |

### Universal Opt-Out Mechanism
- [ ] GPC signal detection implemented
- [ ] GPC signal honoured for sale opt-out
- [ ] GPC signal honoured for targeted advertising opt-out
- [ ] Compliance date: July 15, 2025

## 5. Privacy Notice Checklist

- [ ] Categories of personal data processed disclosed
- [ ] Purposes of processing disclosed
- [ ] Consumer rights and exercise methods described
- [ ] Categories of third parties receiving data disclosed
- [ ] Categories of data sold or shared disclosed
- [ ] Controller contact information provided
- [ ] Notice is clear, accessible, and meaningful
- [ ] Notice versioning and change tracking in place

## 6. Data Protection Assessments

| Processing Activity | DPA Trigger | DPA Conducted | Date | Retained Until |
|---|---|---|---|---|
| | Targeted advertising / Sale / Profiling / Sensitive data / Heightened risk | Yes / No | | |
| | | Yes / No | | |
| | | Yes / No | | |

## 7. Compliance Risk Summary

| Area | Status | Risk Level | Remediation Required |
|------|--------|------------|---------------------|
| Applicability | | | |
| Sensitive data consent | | | |
| Consumer rights handling | | | |
| Universal opt-out | | | |
| Privacy notice | | | |
| Data protection assessments | | | |

## 8. Remediation Plan

| Finding | Priority | Owner | Target Date | Status |
|---------|----------|-------|-------------|--------|
| | High / Medium / Low | | | |
| | | | | |

## 9. Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Privacy Officer | | | |
| Legal Counsel | | | |
| CISO | | | |