# New Jersey Data Privacy Act — Standards and Legal References

## Primary Legislation

- **New Jersey Data Privacy Act (S332/A1971)** — Signed January 16, 2024; effective January 15, 2025. Establishes comprehensive consumer data privacy rights for New Jersey residents.
- **New Jersey Consumer Fraud Act (N.J.S.A. 56:8-1 et seq.)** — NJDPA violations are treated as unlawful practices under this Act, enabling the AG to seek civil penalties.

## Federal Context

- **FTC Act Section 5** — Federal baseline for unfair or deceptive practices; NJDPA extends state-level protections beyond federal minimum.
- **COPPA (Children's Online Privacy Protection Act)** — NJDPA's treatment of known child data (under 13) as sensitive data aligns with COPPA protections.
- **HIPAA Privacy Rule (45 CFR Part 160, 164)** — Health data exemptions under NJDPA reference HIPAA-covered entities and business associates.
- **Gramm-Leach-Bliley Act (GLBA)** — Financial institution exemptions in NJDPA reference GLBA-regulated entities.

## State Privacy Law Comparisons

- **CCPA/CPRA (California)** — Cal. Civ. Code §1798.100 et seq.; NJDPA follows the Virginia model but adds broader sensitive data categories.
- **VCDPA (Virginia Consumer Data Protection Act)** — Va. Code §59.1-575 et seq.; primary structural model for the NJDPA.
- **CPA (Colorado Privacy Act)** — C.R.S. §6-1-1301 et seq.; universal opt-out mechanism requirement parallels NJDPA Section 8.
- **CTDPA (Connecticut Data Privacy Act)** — Conn. Gen. Stat. §42-515 et seq.; similar approach to sensitive data and universal opt-out.

## Industry Standards

- **NIST Privacy Framework v1.0** — Provides organizational privacy risk management framework applicable to NJDPA compliance programs.
- **ISO/IEC 27701:2019** — Privacy information management system standard supporting NJDPA's security and data protection assessment requirements.
- **IAPP CIPM Body of Knowledge** — Professional privacy management practices aligned with state comprehensive privacy law compliance.

## Regulatory Guidance

- **NAAG Privacy Working Group** — Multi-state coordination on enforcement priorities affecting NJDPA-regulated entities.
- **Global Privacy Control (GPC) specification** — Technical standard for universal opt-out mechanism required under NJDPA Section 8.