New Jersey · verified through August 25, 2026

New Jersey: law status and evidence context.

Law status, direct attached-library attribution, and public enforcement context are shown separately. A zero direct total does not mean no enforcement exists.

NJ · 6 requirements mapped / control outcomes supported

Law status

Verified comprehensive law

Yes - New Jersey Data Privacy Law (NJDPL)

Official name / citation
P.L. 2023, c. 266
Status / effective date
Identified as operative law by the Division of Consumer Affairs FAQ
Principal enforcer
New Jersey Attorney General / Division of Consumer Affairs

Direct attached-library attribution

0 cases · $0

These totals are assigned solely by the attachment’s state heading. Shared multistate totals are not allocated in full to every state.

The attached library does not enumerate participant-level allocations for every multistate matter; shared settlement totals are presented once at the national level and are not duplicated into state totals.

Official law sources

Other generally applicable PII law

Also: N.J.S.A. 56:8-161 and 56:8-163 (breach disclosure), P.L. 2019, c. 95 - https://pub.njleg.gov/bills/2018/PL19/95_.PDF

Public enforcement context

Tier 1

Blackbaud, Inc.

$49.5 million total; New Jersey share stated as $1,083,802 · October 5, 2023

New Jersey joined the 50-jurisdiction Blackbaud settlement over the 2020 ransomware breach.

Legal basis: State consumer protection laws, breach-notification laws and HIPAA

Official case source (opens in a new tab)

Mapped control outcomes

1 personal data inventory/data map; 2 sensitive-data discovery; 3 downstream copy tracking; 8 breach blast-radius analysis; 9 retention/minimization; 10 regulator audit evidence

Kestryl can evidence where regulated personal data actually resides across structured stores and unstructured attachments/images, produce audit rows and evidence packs showing when each location was discovered and reviewed, and apply structured-data remediation modes (mask, vault, strip) to reduce exposure. It does not alter source attachments or documents, and its output is technical evidence supporting controls, not proof of legal compliance.