New Jersey's 30-day breach deadline doesn't exist

2026-11-01

If you search for New Jersey's data breach deadline, you'll find a confident answer: 30 days.

One guide says "New Jersey has a 30-day hard deadline for breach notification." Another, marked "Statutes as of early 2026", lists 30 days in its table.

We went looking for those words in New Jersey's own law. Here's what it says:

There's no number. Two bills filed for New Jersey's 2026 session reprint the section, and they show the same words. The second would add a limit of five business days, and its own statement describes the law today: "current law requires that the disclosure be made in the most expedient time possible and without unreasonable delay". You don't propose a new deadline for a law that already has one.

Where it may have come from

We can't say for certain. But one site's page on the same law has an unusually honest note. Its August 2026 update says: "Removed a fabricated 30-day/7-day breach notification deadline that does not appear in current New Jersey law."

A bad number that gets written down once is easy to copy, and a summary of a summary looks just as confident as the law. Pages can cite each other until a mistake feels like a fact.

Why it matters

A wrong number here cuts both ways. A business that plans around 30 days might feel safe on day 29, when the law asks for "the most expedient time possible". And New Jersey requires a report to its State Police "in advance of the disclosure to the customer", which a single number hides.

Every value in our breach table links to the exact words that state it. Where the law gives no number, the cell says so. This isn't legal advice: check the source, and ask a lawyer before you rely on it.