The Letter About Your Information
N.J.S.A. 56:8-163 — the State Police first, then the customer without unreasonable delay
In New Jersey, a business or public entity that must disclose a breach of security of a customer's personal information first reports the breach to the Division of State Police, and then discloses it to the customer in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and the measures needed to determine the scope of the breach.
| Who is told | When, as the section puts it |
|---|---|
| Who is toldThe Division of State Police | When, as the section puts itBefore the disclosure to the customer |
| Who is toldEach affected customer | When, as the section puts itIn the most expedient time possible and without unreasonable delay |
| Who is toldThe consumer reporting agencies, if more than 1,000 persons are notified at one time | When, as the section puts itWithout unreasonable delay |
What counts as personal information, the forms notice may take, and the exceptions for encrypted data are in the section and are not reproduced in full here. Whether a notice was required or on time is a question for the attorney general, a court, and a licensed New Jersey attorney.
Sources for this section (1)
- N.J.S.A. 56:8-163 — Disclosure of breach of security to customers
Legal information, not legal advice. Verified as of September 2026. Applying it to a particular situation is the work of a licensed New Jersey attorney.