New Jersey § 56:8-166

under P.L.2023, c. 266 ( C.56:8-166.4 et seq. ). b. Processors shall adhere to the instructions of the controller and assist the controller

to meet its obligations under this act. Taking into account the nature of processing and the information available to the

processor, the processor shall assist the controller by: (1) taking appropriate technical and organizational measures, insofar as possible,

for the fulfillment of the controller's obligation to respond to consumer requests

to exercise their rights under this act; (2) helping to meet the controller's obligations in relation to the security of processing

the personal data and in relation to notification of a breach of the security of the

system; and (3) providing information to the controller necessary to enable the controller to

conduct and document any data protection assessments required by section 9 of P.L.2023, c. 266 ( C.56:8-166.12 ). The controller and processor are each responsible for only the measures allocated

to them. c. Notwithstanding the instructions of the controller, a processor shall: (1) ensure that each person processing the personal data is subject to a duty of confidentiality

with respect to the data; and (2) engage a subcontractor pursuant to a written contract in accordance with subsection

e. of this section that requires the subcontractor to meet the obligations of the

processor with respect to the personal data. d. Taking into account the context of processing, the controller and the processor

shall implement appropriate technical and organizational measures to ensure a level

of security appropriate to the risk and establish a clear allocation of the responsibilities

between them to implement the measures. e. Processing by a processor shall be governed by a contract between the controller

and the processor that is binding on both parties and that sets forth: (1) the processing instructions to which the processor is bound, including the nature

and purpose of the processing; (2) the type of personal data subject to the processing, and the duration of the processing; (3) the requirements imposed by this subsection and subsections c. and d. of this

section; and (4) the following requirements: (a) At the discretion of the controller, the processor shall delete or return all

personal data to the controller as requested at the end of the provision of services,

unless retention of the personal data is required by law; (b)(i) The processor shall make available to the controller all information necessary

to demonstrate compliance with the obligations in this act; and (ii) The processor shall allow for, and contribute to, reasonable assessments and

inspections by the controller or the controller's designated assessor. Alternatively, the processor may, with the controller's consent, arrange for a qualified

and independent assessor to conduct, at least annually and at the processor's expense,

an assessment of the processor's policies and technical and organizational measures

in support of the obligations under this act using an appropriate and accepted control

standard or framework for the assessment as applicable. The processor shall provide a report of the assessment to the controller upon request. f. In no event may a contract relieve a controller or a processor from the liabilities

imposed on them by virtue of its role in the processing relationship as defined by P.L.2023, c. 266 ( C.56:8-166.4 et seq. ). g. Determining whether a person is acting as a controller or processor with respect

to a specific processing of data shall be a fact-based determination that depends

upon the context in which personal data are to be processed. A person that is not limited in its processing of personal data pursuant to a controller's

instructions, or that fails to adhere to the instructions, shall be deemed a controller

and not a processor with respect to a specific processing of data. A processor that continues to adhere to a controller's instructions with respect

to a specific processing of personal data shall remain a processor. If a processor begins, alone or jointly with others, determining the purposes and

means of the processing of personal data, it shall be deemed a controller with respect

to the processing.