Did You Know?

• There are specific considerations when determining if a breach is reportable
• If a determination is made that notification will not be required, the decision must be documented in writing and maintained for five years
• It is mandatory to report to the Division of State Police in the Department of Law and Public Safety, prior to any disclosure to the affected individuals
• Notifications may only be given by specific methods
• Notifications may be required to the consumer reporting agencies
• If your breach affects residents in other states you will need to notify those residents using that state’s rules
• If a vendor is breached, they must report it to the data owner. The data owner will be responsible to complete the reporting and consumer notification
• Violators are subject to penalties, in addition to any other penalties authorized by law, as well as civil suits, entitling the plaintiff to treble damages and costs
• New Jersey has additional laws regarding how personal data is protected and disposed of to prevent a breach
• Federal laws, industry regulations, and/or out-of-country laws may also apply