Compliance FrameworksAmericas
New Jersey CDPA
New Jersey Consumer Data Privacy Act - controller duties, consumer rights, opt-out.
New Jersey Consumer Data Privacy Act - controller duties, consumer rights, opt-out.
| Short name | NJ CDPA |
| Region | Americas |
| Country or scope | United States |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers NJ CDPA
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for NJ CDPA.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for NJ CDPA and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
NJ-DPA-SEC Data Security Practices | Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal data; integrity-verifiable software supports this duty (NJDPA, P.L. 2023, c. 266, controller-duties provision) | Scan |
NJ-DPA-MIN Minimisation Accountability | Collection must be limited to what is adequate, relevant and reasonably necessary for disclosed purposes; a named processing platform with enumerated components is the evidentiary basis for that limitation (NJDPA, P.L. 2023, c. 266, controller-duties provision) | Scan |
NJ-DPA-PROC Processor Obligations | Processors act only under binding contracts with controller instructions and flow-down duties to subcontractors; third-party processing components should be attributable to named suppliers (NJDPA, P.L. 2023, c. 266, processor provisions) | Scan |
NJ-DPA-DPIA Data Protection Assessment Readiness | Data protection assessments are required for heightened-risk processing including targeted advertising, sale, profiling and sensitive data; risk assessment requires the versions of the processing software to be recorded (NJDPA, P.L. 2023, c. 266, data protection assessment provisions) | Scan |
NJ-DPA-OPTOUT Universal Opt-Out and Rights Readiness | Controllers must honor consumer rights requests and universal opt-out preference signals for targeted advertising and sale; executing these across systems requires unambiguous identification of the components involved (NJDPA, P.L. 2023, c. 266, consumer-rights and opt-out provisions) | Scan |
NJ-DPA-CONTACT Accountable Point of Contact | The required privacy notice must tell consumers how to contact the controller and exercise their rights; a recorded, reachable creator/owner contact for system documentation demonstrates that accountability chain (NJDPA, P.L. 2023, c. 266, privacy-notice provisions) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
NJ-P2023-332-Sec3 | Consumer Rights: Access, Correction, Deletion & Portability |
NJ-P2023-332-Sec4 | Opt-Out of Sale, Targeted Advertising & Profiling |
NJ-P2023-332-Sec5 | Sensitive Data Consent |
NJ-P2023-332-Sec8 | Data Protection Assessment |
NJ-P2023-332-Sec9 | Processor Agreements |
NJ-P2023-332-Sec2 | Privacy Notice Requirements |
NJ-P2023-332-Sec6 | Universal Opt-Out Signal |
NJ-P2023-332-Sec7 | Children's Data Protections |
Policy templates
Written for NJ CDPA:
- New Jersey CDPA State Privacy Notice
- New Jersey CDPA Sensitive Data Consent Policy
And 22 from the standard set, adapted to NJ CDPA.