New Year, New Privacy Laws: Five States Implement Comprehensive Data Privacy Regulations

As data privacy continues to take center stage in regulatory discussions, five U.S. states - Delaware, Iowa, Nebraska, New Hampshire, and New Jersey have introduced new consumer privacy laws that took effect in January 2025. These laws impose new obligations on businesses while granting consumers greater control over their personal data.

If your company operates in these states or collects personal data from their residents, it’s time to review and update your compliance strategy. Here’s what you need to know about these new state privacy laws:

1. Delaware Personal Data Privacy Act (DPDPA)

Effective Date: January 1, 2025

Who Must Comply? Businesses that:

• Control or process 35,000+ Delaware residents’ personal data (excluding payment data) OR
• Control/process 10,000+ Delaware residents’ data and derive 20%+ of revenue from selling data. Penalties: Up to $10,000 per violation, with a 60-day cure period available until December 31, 2025.

2. Iowa Consumer Data Protection Act (ICDPA)

Effective Date: January 1, 2025

Who Must Comply? Businesses that:

• Control/process 100,000+ Iowa residents’ personal data OR
• Control/process 25,000+ Iowa residents’ data and derive 50%+ of revenue from selling data. Penalties: Up to $7,500 per violation, with a 90-day cure period (no expiration).

3. Nebraska Data Privacy Act (NDPA)

Effective Date: January 1, 2025

Who Must Comply? Businesses that:

• Engage in processing or selling personal data AND
• Do not qualify as a small business under U.S. Small Business Administration guidelines. Penalties: Up to $7,500 per violation, with a 30-day cure period (no expiration).

4. New Hampshire Data Privacy Act (NHDPA)

Effective Date: January 1, 2025

Who Must Comply? Businesses that:

• Control/process 35,000+ New Hampshire residents’ personal data (excluding payment data) OR
• Control/process 10,000+ residents’ data and derive 25%+ of revenue from selling data. Penalties: Up to $10,000 per violation, with a 60-day cure period available until December 31, 2025.

5. New Jersey Data Privacy Act (NJDPA)

Effective Date: January 15, 2025

Who Must Comply? Businesses that:

• Control/process 100,000+ New Jersey residents’ personal data OR
• Control/process 25,000+ residents’ data and derive revenue or receive discounts from selling data. Penalties: Up to $7,500 per violation, with a 30-day cure period available until July 15, 2026.

What Do These Laws Mean for Businesses

Consumer Rights Expansion: Individuals now have increased rights, including accessing, correcting, and deleting personal data, as well as opting out of certain processing activities.

Compliance Burden for Businesses: Companies must review their data collection and processing activities to ensure compliance with these new regulations.

Increased Enforcement Risks: Non-compliance may lead to hefty fines and potential regulatory scrutiny.

Action Steps:

Conduct a Data Inventory: Understand what personal data your company collects and processes.

Update Privacy Policies & Disclosures: Ensure transparency regarding data collection, processing, and consumer rights.

Implement Consumer Rights Request Processes: Prepare for data access, correction, and deletion requests.

Review Third-Party Data Sharing Agreements: Ensure compliance with these new regulations when working with vendors and partners.

Stay Ahead of Privacy Regulations

As more states adopt comprehensive data privacy laws, companies must stay proactive in their compliance strategies. Whether you're a fintech company, e-commerce business, or service provider, these laws will impact how you handle consumer data in 2025 and beyond.

Is your business ready for the new privacy landscape? Let’s discuss how these regulations may impact your operations! #DataPrivacy #Compliance #PrivacyRegulations #CyberSecurity #ConsumerRights

For a comprehensive understanding of the law and its legal implications, it is advisable to review the official legislative text and seek your legal counsel's advice.

Maintaining compliance is essential, proactive measures today can mitigate regulatory risks tomorrow.

?? Sources & Further Reading:

Delaware Personal Data Privacy Act

Iowa Consumer Data Protection Act

Nebraska Data Privacy Act

New Hampshire Data Privacy Act

New Jersey Data Privacy Act

Stay compliant and stay ahead folks!

Best regards,

DG