NJ Data Privacy Law Shredding Requirements
Reviewed October 12, 2026. New Jersey data privacy requirements do not all apply to the same organizations, records or situations. A business can have a duty to destroy eligible customer records without meeting the thresholds for the state’s broader consumer privacy law. Before arranging shredding, identify the applicable rules, confirm what must still be retained, and approve a specific destruction batch.
This guide separates customer-record disposal from consumer privacy rights and breach notification. It is general information, not legal advice or a guarantee that a shredding service satisfies every obligation.
Three New Jersey rules that should not be confused
| Rule | What it addresses | What it means for disposal |
|---|---|---|
| Customer-record destruction: N.J.S.A. 56:8-162 | Customer records containing personal information that are no longer to be retained by a business or public entity. | Destroy or arrange destruction so the information is unreadable, undecipherable or nonreconstructable through generally available means. |
| New Jersey Data Privacy Law: P.L. 2023, c. 266 | Consumer data rights and controller/processor responsibilities, with coverage thresholds and exclusions. | Connect an approved deletion decision to the systems and records involved; do not treat a paper pickup as a complete privacy program. |
| Breach notification: N.J.S.A. 56:8-163 | Specified breaches involving computerized records containing personal information. | Escalate a suspected incident for assessment. Routine shredding is not a substitute for notification duties. |
The Division of Consumer Affairs publishes the Identity Theft Prevention Act text, including the customer-record destruction and breach-notification provisions. The destruction section permits shredding, erasing or otherwise modifying the information to achieve its stated result. It does not name a required vendor certification or require a destruction certificate.
Who is covered by the consumer privacy law?
According to the Division’s NJ Data Privacy Law FAQs, the law took effect January 15, 2025. A consumer is a New Jersey resident acting in an individual or household context, not an employment or commercial context.
The enacted law, section 2, generally covers controllers doing business in New Jersey or targeting residents when, during a calendar year, they either:
- Control or process personal data of at least 100,000 consumers, excluding data processed solely to complete a payment transaction; or
- Control or process personal data of at least 25,000 consumers and derive revenue, or receive a discount on goods or services, from selling personal data.
Exclusions and processor duties also matter. Nonprofits and small businesses are not automatically exempt merely because of their size or organizational label. Conversely, those thresholds are not a blanket test for every NJ privacy obligation, including customer-record destruction.
There is also a 2026 amendment: P.L. 2026, c. 25 adds a sensitive-data sale prohibition in section 9 that applies regardless of the number of consumers whose data an individual or entity controls or processes. That is a sale restriction, not an instruction to shred every sensitive record immediately. Our separate data-broker law timeline discusses the registry issue; registration and records disposal are different questions.
Retention and legal holds come before destruction
Neither a privacy request nor a full storage room establishes that every file can be destroyed. The consumer privacy law preserves the ability to comply with law, respond to government inquiries and investigate or defend legal claims. Have the responsible records owner or legal adviser assess applicable exceptions and obligations before releasing records.
- Identify the record category and responsible department.
- Check the retention schedule, governing requirements and contract commitments.
- Exclude records subject to litigation holds, investigations or unresolved access requests.
- Document the approval and keep retained material separate from the destruction batch.
For the narrower statutory disposal question, see our New Jersey customer-record destruction guide. A vendor should receive an approved batch, not decide your retention deadlines.
Turn the decision into a controlled handoff
For paper, keep approved records in restricted-access storage or suitable secure containers until handoff. Confirm the collection location, authorized contact, approximate volume, access conditions, and whether you prefer on-site or off-site handling. Avoid mixing files that still require review into the same containers.
Our paper shredding services page describes mobile, off-site, one-time purge and scheduled options. Ask which arrangement fits your location and volume, and confirm container, witness and completion-documentation arrangements in the quote.
For digital records, identify the actual storage media and copies with your IT team. NIST’s current SP 800-88 Revision 2, finalized September 26, 2025, supersedes Revision 1 and addresses a sanitization program based on information sensitivity. Paper shredding does not dispose of database copies, backups or device storage. Recycling a device alone does not establish that its data was sanitized.
What completion documentation can show
Keep the batch approval, handoff record and agreed destruction documentation together. They help record the work performed, but do not prove that the original retention decision was lawful or that every copy was located. Confirm what a certificate will identify and reconcile any exceptions. No certificate guarantees compliance with all state and federal laws.
Frequently asked questions
Does NJ law require professional shredding for every document?
The customer-record provision specifies an outcome and allows several methods. Match the method to the records and applicable rules; do not assume every ordinary document falls within the same statutory category.
Does shredding prevent all data breaches?
No. Secure disposal addresses exposure from discarded records. It cannot prevent phishing, unauthorized system access or other unrelated incidents.
What should I include in a quote request?
Provide your NJ municipality or ZIP code, approximate box or container count, one-time or recurring need, building access constraints and documentation questions. Do not send customer records, account credentials or sensitive personal details in a general inquiry.
Request a shredding quote
Call (201) 371-5900 or request a quote. NJ Shredding’s published service information lists Bergen, Essex, Hudson, Passaic, Morris, Union, Middlesex, Monmouth, Somerset, Mercer, Ocean and Burlington counties. Confirm service availability for your address and preferred handling method before making arrangements.
