# New Jersey Data Privacy Act — Compliance Workflows

## Workflow 1: Applicability Assessment
1. Determine if the organization conducts business in New Jersey or targets New Jersey residents.
2. Calculate annual consumer data processing volume (threshold: 100,000 consumers excluding payment-only transactions, or 25,000 consumers with revenue from data sales).
3. Check entity-level exemptions (government agencies, HIPAA-covered entities, GLBA-regulated financial institutions, higher education institutions, nonprofits).
4. Check data-level exemptions (HIPAA-protected health information, GLBA financial data, employee data in employment context, B2B contact data).
5. Document applicability determination with supporting evidence.

## Workflow 2: Sensitive Data Compliance
1. Inventory all personal data categories collected and processed.
2. Identify data elements meeting the NJDPA sensitive data definition (racial/ethnic origin, religious beliefs, health data, financial information, sexual orientation, citizenship/immigration status, transgender/non-binary status, biometric data, child data, precise geolocation).
3. Evaluate current lawful basis for processing each sensitive data category.
4. Implement opt-in consent mechanism for all sensitive data processing.
5. Update privacy notice to disclose sensitive data categories and processing purposes.
6. Document consent records with timestamp, scope, and mechanism.

## Workflow 3: Consumer Rights Request Handling
1. Establish intake channels for consumer rights requests (web form, email, toll-free number).
2. Implement identity verification process (reasonable steps, must not require creation of an account).
3. Configure response workflow with 45-day SLA tracking and 45-day extension capability.
4. Build opt-out processing for sale, targeted advertising, and profiling (15 business day SLA).
5. Implement universal opt-out mechanism (GPC) recognition by July 15, 2025.
6. Create appeal process for denied requests with AG complaint notification in appeal response.
7. Maintain request log tracking volume, type, response time, and outcome.

## Workflow 4: Data Protection Assessment
1. Identify processing activities requiring a DPA under NJDPA: targeted advertising, sale of personal data, profiling with legal/significant effects, sensitive data processing, processing presenting heightened risk.
2. Document the processing activity, purposes, and necessity assessment.
3. Assess benefits to the controller, consumer, and public against potential risks to consumer rights.
4. Evaluate safeguards and mitigations to reduce identified risks.
5. Retain DPA documentation for at least three years after processing ceases.
6. Make DPAs available to the AG upon request.

## Workflow 5: Privacy Notice and Transparency Update
1. Review current privacy notice against NJDPA Section 7 requirements.
2. Add required disclosures: categories of personal data processed, purposes of processing, consumer rights and exercise methods, categories of third-party data sharing, categories of data sold, controller contact information.
3. Ensure notice is clear, accessible, and meaningful.
4. Publish updated notice at least 15 days before the NJDPA effective date.
5. Implement notice versioning and change tracking.