Privacy Law Library

Nebraska Data Privacy Act

NDPA

Comprehensive privacy · Children · Biometric · Genetic · Location · Data security

Nebraska's comprehensive consumer privacy law, modeled on the Texas Data Privacy and Security Act, gives Nebraska consumers rights to access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and significant profiling. It covers almost every for-profit business that is not a federally defined small business, requires opt-in consent for sensitive data (including precise geolocation, genetic and biometric data, and a known child's data), and is enforced only by the Attorney General.

Where
Nebraska
Citation
Neb. Rev. Stat. 87-1101 to 87-1130
Status
In force
In force since
2025-01-01
Enforced by
Nebraska Attorney General (exclusive, 87-1119 to 87-1124)
People can sue
No
Penalties
After a mandatory 30-day written notice and cure period, civil penalty of up to $7,500 per violation, plus injunctive relief and the Attorney General's fees and investigative costs (87-1122, 87-1124). No private right of action (87-1125).
Applies to
  • Persons that conduct business in Nebraska or produce a product or service consumed by Nebraska residents, process or sell personal data, and are not a small business under the federal Small Business Act (no revenue or volume threshold) (87-1103(1))
  • Small businesses are covered only by the ban on selling sensitive data without prior consent (87-1103(1)(c), 87-1118)
  • Processors acting on behalf of controllers (87-1115)
  • Exempt: state agencies and political subdivisions, GLBA financial institutions and affiliates, HIPAA covered entities and business associates, nonprofits, institutions of higher education, and electric and natural gas utilities (87-1103(2)); data-level exemptions for PHI, health records, research data and other listed categories (87-1104)

What a privacy notice must say

  • Provide a reasonably accessible, clear privacy notice listing categories of personal data (including sensitive data), purposes, how to exercise and appeal rights, categories of data shared and of third parties, and request methods.Neb. Rev. Stat. 87-1113
  • Clearly and conspicuously disclose any sale of personal data or processing for targeted advertising and how to opt out.Neb. Rev. Stat. 87-1114 · Only if: If the controller sells personal data or engages in targeted advertising

Rights it gives people

  • Consumers may confirm processing and access, correct, delete, and obtain a portable copy of their personal data, and opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects; a parent or guardian may act for a known child.Neb. Rev. Stat. 87-1107

Practices it requires

  • Limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes, and do not process for incompatible purposes without consent or discriminate against consumers for exercising rights.Neb. Rev. Stat. 87-1112(1)(a), (2)(a)-(c)
  • Conduct and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data processing, and other heightened-risk processing.Neb. Rev. Stat. 87-1116
  • Small businesses otherwise exempt may not sell sensitive personal data without the consumer's prior consent.Neb. Rev. Stat. 87-1118 · Only if: Applies to small businesses under 87-1103(1)(c)
  • Obtain consumer consent before processing sensitive data; process a known child's sensitive data in accordance with COPPA.Neb. Rev. Stat. 87-1112(2)(d)
  • Respond to authenticated requests within 45 days (one 45-day extension with notice), free of charge up to twice a year, and explain any refusal with appeal instructions.Neb. Rev. Stat. 87-1108
  • Maintain a conspicuous appeal process and answer appeals in writing within 60 days; on denial, give the consumer a way to complain to the Attorney General.Neb. Rev. Stat. 87-1109

Security duties

  • Establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data.Neb. Rev. Stat. 87-1112(1)(b)

Other duties

  • Controller-processor contracts must set processing instructions, nature, purpose, data types, duration, and duties such as confidentiality, deletion or return, and subcontractor terms.Neb. Rev. Stat. 87-1115(2)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.