ShareAndGoShareAndGo

Data breach notification

New Jersey data breach notification law

New Jersey's breach provisions sit in the Identity Theft Prevention Act at N.J. Stat. Ann. §§ 56:8-161 and 56:8-163.

This page was checked against the official session law P.L.2019, c.95 on the New Jersey Legislature's site, which restates both sections as amended.

Police first, customers second

In New Jersey, the State Police hear first. A business shall, in advance of the disclosure to the customer, report the breach of security and any information pertaining to it to the Division of State Police in the Department of Law and Public Safety for investigation or handling.

The customer disclosure then follows in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement. The session law sets no number of days for either step. The State Police report applies to any breach that requires notice to customers, with no minimum count.

Defining personal information

The definition links an individual's first name or first initial and last name with one or more listed elements.

ElementSource wording
Social Security numberSocial Security number.
Licenses and IDsDriver's license number or State identification card number.
Financial accountsAccount or card number with any required code or password.
Online accountsA user name, email address or other account-holder identifier in combination with any password or security question and answer that would permit access to an online account.

Dissociated data counts too, if the means to link it back to a person were also accessed.

When notice is not needed

Two limits narrow the duty. First, it applies when access to the personal information has not been secured by encryption or by any other method or technology that renders it unreadable or unusable. Second, disclosure is not required if the business establishes that misuse of the information is not reasonably possible. That determination must be documented in writing and kept for five years.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

In each data room the watermark is a setting that starts on. Recipients confirm their email address with a six-digit code and do not need an account. Groups reach only their own folders, and the chained log exports as CSV, which gives a New Jersey team a dated list of who opened what inside ShareAndGo when investigators ask.

New Jersey questions

Who hears before customers do?
The Division of State Police in the Department of Law and Public Safety, which receives a report in advance of the customer disclosure.
Is there a fixed deadline?
No day count; the disclosure is made in the most expedient time possible and without unreasonable delay.
Can a business decide notice is unnecessary?
Only if it establishes that misuse of the information is not reasonably possible.
Do online login details count?
Yes, an account-holder identifier with a password or security question and answer that opens an online account is covered.

A note on the source

The consolidated code site did not load for our reader, so whether any amendment after P.L.2019, c.95 changed these sections was not checked.

Checked against New Jersey's session law P.L.2019, c.95 on November 2, 2026. This is general information, not legal advice.

Further

Breach notification laws by state

Breach notification rules across the US.

Compare data rooms

Compare data rooms.

ShareAndGo home

ShareAndGo home.