On his last day in office, January 20, 2026, former New Jersey Governor Phil Murphy signed an amendment to the New Jersey Data Privacy Act, A5017. The bill amends the state’s comprehensive privacy law to add new data- and entity-level exemptions and to expand the definition of de-identified data. The amendment took effect immediately.
The amendment adds data- and entity-level exemptions for:
- Information treated like protected health information collected, used, or disclosed by a covered entity or business associate subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), subject to certain criteria;
- Human subjects research conducted in accordance with good clinical practice guidelines issued by The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use;
- Insurance-support organizations as defined under New Jersey law; and
- National securities associations registered pursuant to section 15A of the Securities Exchange Act of 1934 and applicable regulations.
This amendment also expands the definition of de-identified data to include data de-identified in accordance with HIPAA where any recipients of the data are contractually prohibited from attempting to reidentify the data.