Nebraska Privacy Law

Nebraska (NDPA)

Last updated Sep 29, 2026

NDPA Enacted, in effect

Who this affects: This page tracks Nebraska’s NDPA, which governs controllers and processors.

Who it applies to: Entities that do business in Nebraska or serve its residents, process or sell personal data, and are not small businesses under the federal Small Business Act (a separate sensitive-data rule covers those).

Content on this page is not legal advice

Must, Can't, Should NDPA Timeline

Jan 1, 2025

Effective ↗

Attorney General

Enforced by ↗

$7,500

Maximum penalty per violation ↗

None

Private right of action ↗

The law, in plain English

Must · Can’t · Should

NDPA, distilled to what actually changes your week. Read one column to know your floor, your hard limits, and the further obligations and good practices worth planning for.

Must

Respond to access, correction, deletion and portability requests within forty-five days; explain refusals and how to appeal. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1108 “A controller shall respond to the consumer request without undue delay within forty-five days after the date of receipt of the request.” Read the statute NE-87-1108 “the controller shall inform the consumer within forty-five days after the date of receipt of the request of the justification for declining to comply and provide instructions on how to appeal the decision” Read the statute NE-87-1107 “Confirm whether a controller is processing the consumer's personal data and to access the personal data” Read the statute NE-87-1107 “Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data” Read the statute NE-87-1107 “Delete personal data provided by or obtained about the consumer” Read the statute NE-87-1107 “If the data is available in a digital format and the processing is completed by automated means, obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance” Read the statute
Honor authorized-agent opt-outs sent via browser or device settings if consumer identity and agent authority are verifiable. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1111 “A consumer may designate an authorized agent using a technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of the processing of the consumer's personal data under subdivisions (2)(e)(i) and (ii) of section 87-1107. A controller shall comply with an opt-out request received from an authorized agent under this subsection if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf.” Read the statute NE-87-1111 “A controller shall comply with an opt-out request received from an authorized agent under this subsection if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf.” Read the statute
Conduct and document a data protection assessment for each listed processing activity; produce it on an Attorney General demand. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1116 “A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal data” Read the statute NE-87-1116 “A controller shall make a data protection assessment requested under subsection (2) of section 87-1121 available to the Attorney General pursuant to a civil investigative demand under section 87-1121.” Read the statute

Can't

Process a consumer's sensitive data without consent, or a known child's sensitive data other than in accordance with COPPA. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1112 “Process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the federal Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq., as such act existed on January 1, 2024” Read the statute
Require a new account to exercise a privacy right, or discriminate against a consumer for exercising any privacy right. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1111 “A controller shall not require a consumer to create a new account to exercise a consumer right under the Data Privacy Act, but may require a consumer to use an existing account.” Read the statute NE-87-1112 “Discriminate against a consumer for exercising any of the consumer rights contained in the Data Privacy Act, including by denying a good or service, charging a different price or rate for a good or service, or providing a different level of quality of a good or service to the consumer” Read the statute
Process personal data for a purpose neither reasonably necessary to nor compatible with the disclosed purpose, absent consent. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1112 “process personal data for a purpose that is neither reasonably necessary to nor compatible with the disclosed purpose for which the personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent” Read the statute

Should

Stand up two or more secure and reliable request methods, and answer requests free of charge up to twice annually per consumer. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1111 “A controller shall establish two or more secure and reliable methods to enable a consumer to submit a request to exercise consumer rights under the Data Privacy Act.” Read the statute NE-87-1108 “A controller shall provide information in response to a consumer request free of charge, up to twice annually per consumer.” Read the statute
Run an appeal process, answer appeals in writing by the sixtieth day, and on denial provide the online way to contact the AG. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1109 “A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision under subsection (3) of section 87-1108” Read the statute NE-87-1109 “A controller shall inform the consumer in writing of any action taken or not taken in response to an appeal under this section not later than the sixtieth day after the date of receipt of the appeal” Read the statute NE-87-1109 “If the controller denies an appeal, the controller shall provide the consumer with the online mechanism described in section 87-1108 through which the consumer may contact the Attorney General” Read the statute
Sign processor contracts setting instructions, nature and purpose, data type, duration, and both parties' rights and obligations. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. NE-87-1115 “A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller. The contract shall include: (a) Clear instructions for processing data; (b) The nature and purpose of processing; (c) The type of data subject to processing; (d) The duration of processing; (e) The rights and obligations of both parties” Read the statute

These are the highlights we judge most important, not everything NDPA requires. The comprehensive law section below covers the full detail, fact by fact, with the statutory text behind every one.

The comprehensive law

Nebraska Data Privacy Act

NDPA (LB 1074) is Nebraska’s comprehensive privacy law. Every fact was extracted from the primary statute by the DataGrail regulation engine and is grounded to the cited source. Scan the facts; the exact statutory text sits one click away on each source link.

Status

Enacted, in effect

Archived excerpt — the text we read Sec. 100. Sections 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 93, 94, 95, 98, and 102 of this act become operative on January 1, 2025. Sections 31, 32, 33, 34, 35, 36, 52, 54, 55, 56, 60, 61, 62, 63, 64, 65, 67, 68, 69, 70, 71, 72, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 96, 97, and 103 of this act become operative three calendar m… Archived from source — captured 2026-08-14 · snapshot d9c7b848 Verify at the source

Corroborated by Privacy-law tracker

Effective

January 1, 2025

Archived excerpt — the text we read Sec. 100. Sections 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 93, 94, 95, 98, and 102 of this act become operative on January 1, 2025. Sections 31, 32, 33, 34, 35, 36, 52, 54, 55, 56, 60, 61, 62, 63, 64, 65, 67, 68, 69, 70, 71, 72, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 96, 97, and 103 of this act become operative three calendar mo… Archived from source — captured 2026-08-14 · snapshot d9c7b848 Verify at the source

Corroborated by Privacy-law tracker Regulator guidance

Signed

April 17, 2024

Neb. LB 1074 (2024) bill history, Nebraska Legislature Archived excerpt — the text we read …ions/portions of LB1075 amended into LB1074 by AM2560 0 Apr 25, 2024 Provisions/portions of LB872 amended into LB1074 by AM2560 0 Apr 25, 2024 Provisions/portions of LB710 amended into LB1074 by AM2560 0 Apr 18, 2024 Approved by Governor on April 17, 2024 1793 Apr 18, 2024 Presented to Governor on April 11, 2024 1791 Apr 11, 2024 President/Speaker signed 1775 Apr 11, 2024 Passed on Final Reading with Emergency Clause 47-0-2 1755 Vote Apr 11, 2024 Dispensing of readi… Archived from source — captured 2026-08-15 · snapshot 3a0299ea Verify at the source

Enforced by

Attorney General

Archived excerpt — the text we read 87-1119. Attorney General; enforcement. The Attorney General has exclusive authority to enforce the Data Privacy Act. Source Laws 2024, LB1074, § 19. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legisl… Archived from source — captured 2026-08-15 · snapshot 07ed3c09 Verify at the source

Maximum penalty per violation

$7,500

“is liable for a civil penalty in an amount not to exceed seven thousand five hundred dollars for each violation” View the statute

Right to cure

30 days

Archived excerpt — the text we read 87-1122. Controller or processor; notification of violations; response. Before bringing an action under section 87-1124, the Attorney General shall notify a controller or processor in writing, not later than the thirtieth day before bringing the action, identifying the specific provisions of the Data Privacy Act the Attorney General alleges have been or are being violated. The Attorney General may not bring an action against the controller or processor if: (1) Within the thirty-day period, the controller or processor cures the identified violation; and (2) The controller or processor provides the Attorney General: (a) A written statement that the controller or processor cured the alleged violation and supportive documentation to show how such violation was cured; and (b) An express written statement that the controller or processor shall not commit any such violation after the alleged violation has been cured. Source Laws 2024, LB1074, § 22. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legisl… Archived from source — captured 2026-08-15 · snapshot cca9a0c6 Verify at the source

Private right of action

No private right of action.

Archived excerpt — the text we read 87-1125. Private right of action. The Data Privacy Act shall not be construed as providing a basis for, or being subject to, a private right of action for a violation of the Data Privacy Act or any other law. Source Laws 2024, LB1074, § 25. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legisl… Archived from source — captured 2026-08-15 · snapshot 99b25f02 Verify at the source

Corroborated by Privacy-law tracker

Universal opt-out signal

Required

Archived excerpt — the text we read …esignate another person to serve as the consumer's authorized agent and act on the consumer's behalf to opt out of the processing of the consumer's personal data under subdivisions (2)(e)(i) and (ii) of section 87-1107. A consumer may designate an authorized agent using a technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of the processing of the consumer's personal data under subdivisions (2)(e)(i) and (ii) of section 87-1107. A controller shall comply with an opt-out request received from an authorized agent under this subsection if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf. A controller is not required to comply with an opt-out request received from an authorized agent under this subsection if: (a) The authorized agent does not communicate the request to the controller in a clear and unam… Archived from source — captured 2026-08-15 · snapshot 48c19e58 Verify at the source

What the law gives consumers

Right to access Archived excerpt — the text we read … a known child, a parent or legal guardian of the child may exercise the consumer rights on behalf of the known child. (2) A controller shall comply with an authenticated consumer request to exercise the right to: (a) Confirm whether a controller is processing the consumer's personal data and to access the personal data; (b) Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (c) Delete personal data provided by o… Archived from source — captured 2026-08-15 · snapshot 966bd454 Verify at the source
Right to correct Archived excerpt — the text we read …n child. (2) A controller shall comply with an authenticated consumer request to exercise the right to: (a) Confirm whether a controller is processing the consumer's personal data and to access the personal data; (b) Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (c) Delete personal data provided by or obtained about the consumer; (d) If the data is available in a digital format and the processing is completed by automated means, obtain a copy of the consumer's personal data … Archived from source — captured 2026-08-15 · snapshot 966bd454 Verify at the source
Right to delete Archived excerpt — the text we read …ta and to access the personal data; (b) Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (c) Delete personal data provided by or obtained about the consumer; (d) If the data is available in a digital format and the processing is completed by automated means, obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable … Archived from source — captured 2026-08-15 · snapshot 966bd454 Verify at the source
Right to data portability Archived excerpt — the text we read …onsumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; (c) Delete personal data provided by or obtained about the consumer; (d) If the data is available in a digital format and the processing is completed by automated means, obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance; or (e) Opt out of the processing of the personal data for purposes of: (i) Targeted advertising; (ii) The sale of personal data; or (iii) Profiling in furtherance of a decision that produces a legal or similarly si… Archived from source — captured 2026-08-15 · snapshot 966bd454 Verify at the source
Right to opt out of sale Archived excerpt — the text we read …ible, readily usable format that allows the consumer to transmit the data to another controller without hindrance; or (e) Opt out of the processing of the personal data for purposes of: (i) Targeted advertising; (ii) The sale of personal data; or (iii) Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer. Source Laws 2024, LB1074, § 7. Frequent Questions Americans with Disabilities Act Noti… Archived from source — captured 2026-08-15 · snapshot 966bd454 Verify at the source
Right to opt out of targeted advertising Archived excerpt — the text we read … the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance; or (e) Opt out of the processing of the personal data for purposes of: (i) Targeted advertising; (ii) The sale of personal data; or (iii) Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer. Source Laws 2024, LB1074, § 7. Frequent Questions Ame… Archived from source — captured 2026-08-15 · snapshot 966bd454 Verify at the source
Right to opt out of profiling for significant decisions Archived excerpt — the text we read …ws the consumer to transmit the data to another controller without hindrance; or (e) Opt out of the processing of the personal data for purposes of: (i) Targeted advertising; (ii) The sale of personal data; or (iii) Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer. Source Laws 2024, LB1074, § 7. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legisl… Archived from source — captured 2026-08-15 · snapshot 966bd454 Verify at the source
Sensitive data: opt-in consent required Archived excerpt — the text we read …ontained in the Data Privacy Act, including by denying a good or service, charging a different price or rate for a good or service, or providing a different level of quality of a good or service to the consumer; or (d) Process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the federal Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq., as such act exist… Archived from source — captured 2026-08-15 · snapshot f5f40690 Verify at the source
Right to appeal Archived excerpt — the text we read 87-1109. Appeal process. (1) A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision under subsection (3) of section 87-1108. (2) The appeal process must be conspicuously available and similar to the process for initiating an action to exercise consumer rights by submitting a request under section 87-1… Archived from source — captured 2026-08-15 · snapshot 6a51a469 Verify at the source
Right against discrimination Archived excerpt — the text we read …cessed, as disclosed to the consumer, unless the controller obtains the consumer's consent; (b) Process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers; (c) Discriminate against a consumer for exercising any of the consumer rights contained in the Data Privacy Act, including by denying a good or service, charging a different price or rate for a good or service, or providing a different level of quality of a good or service to the consumer; or (d) Process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive dat… Archived from source — captured 2026-08-15 · snapshot f5f40690 Verify at the source
Not granted: Private right of action Archived excerpt — the text we read 87-1125. Private right of action. The Data Privacy Act shall not be construed as providing a basis for, or being subject to, a private right of action for a violation of the Data Privacy Act or any other law. Source Laws 2024, LB1074, § 25. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legisl… Archived from source — captured 2026-08-15 · snapshot 99b25f02 Verify at the source

Who the law governs

Controllers Archived excerpt — the text we read …rn; (7)(a) Consumer means an individual who is a resident of this state acting only in an individual or household context. (b) Consumer does not include an individual acting in a commercial or employment context; (8) Controller means an individual or other person that, alone or jointly with others, determines the purpose and means of processing personal data; (9) Covered entity has the same meaning as defined in 45 C.F.R. 160.103, as such regulation existed on January 1, 2024; (10) Dark pattern means a user interface designed or manipulated with the effect of substantiall… Archived from source — captured 2026-08-15 · snapshot 2d9c2b56 Verify at the source
Processors Archived excerpt — the text we read … of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data; (24) Processor means a person that processes personal data on behalf of a controller; (25) Profiling means any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, healt… Archived from source — captured 2026-08-15 · snapshot 2d9c2b56 Verify at the source

Exemptions

State agency or political subdivision Archived excerpt — the text we read … the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section 87-1118 applies to a person described by this subdivision. (2) The Data Privacy Act does not apply to any: (a) State agency or political subdivision of this state; (b) Financial institution, affiliate of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., as such title existed on January 1, 2024; (c) Covered entity or busin… Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
GLBA: financial institutions, their affiliates, and data subject to Title V Entity- and data-level Archived excerpt — the text we read …nuary 1, 2024, except to the extent that section 87-1118 applies to a person described by this subdivision. (2) The Data Privacy Act does not apply to any: (a) State agency or political subdivision of this state; (b) Financial institution, affiliate of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., as such title existed on January 1, 2024; (c) Covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, … Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
HIPAA covered entities and business associates Archived excerpt — the text we read …bdivision of this state; (b) Financial institution, affiliate of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., as such title existed on January 1, 2024; (c) Covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 C.F.R. parts 160 and 164, as such parts existed on January 1, 2024, and Division A, Title XIII, and Division B, Title IV, of the federal Health Information Technology for Economic and Clinical Health Act, Public Law No. 111-5, as such act exist… Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
Nonprofit organizations as defined in 87-1102 Nebraska Nonprofit Corporation Act corporations; 501(c)(3), (c)(6) or (c)(12) organizations; 501(c)(4) insurance-fraud-prevention organizations; and subsidiaries or affiliates of cooperatives. Archived excerpt — the text we read …anuary 1, 2024, and Division A, Title XIII, and Division B, Title IV, of the federal Health Information Technology for Economic and Clinical Health Act, Public Law No. 111-5, as such act existed on January 1, 2024; (d) Nonprofit organization; (e) Institution of higher education; (f) Electric supplier or supplier of electricity as defined in section 70-1001.01; (g) Natural gas public utility as defined in section 66-1802; or (h) Natural gas utility owned… Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
Institutions of higher education Archived excerpt — the text we read …A, Title XIII, and Division B, Title IV, of the federal Health Information Technology for Economic and Clinical Health Act, Public Law No. 111-5, as such act existed on January 1, 2024; (d) Nonprofit organization; (e) Institution of higher education; (f) Electric supplier or supplier of electricity as defined in section 70-1001.01; (g) Natural gas public utility as defined in section 66-1802; or (h) Natural gas utility owned or operated by a city or a metropolit… Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
Electric suppliers Archived excerpt — the text we read …V, of the federal Health Information Technology for Economic and Clinical Health Act, Public Law No. 111-5, as such act existed on January 1, 2024; (d) Nonprofit organization; (e) Institution of higher education; (f) Electric supplier or supplier of electricity as defined in section 70-1001.01; (g) Natural gas public utility as defined in section 66-1802; or (h) Natural gas utility owned or operated by a city or a metropolitan utilities district. Source Laws 2024, LB1074, § 3. Frequent Questions America… Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
Natural gas public utilities Archived excerpt — the text we read …, Public Law No. 111-5, as such act existed on January 1, 2024; (d) Nonprofit organization; (e) Institution of higher education; (f) Electric supplier or supplier of electricity as defined in section 70-1001.01; (g) Natural gas public utility as defined in section 66-1802; or (h) Natural gas utility owned or operated by a city or a metropolitan utilities district. Source Laws 2024, LB1074, § 3. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Te… Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
Municipally owned natural gas utilities Archived excerpt — the text we read …d) Nonprofit organization; (e) Institution of higher education; (f) Electric supplier or supplier of electricity as defined in section 70-1001.01; (g) Natural gas public utility as defined in section 66-1802; or (h) Natural gas utility owned or operated by a city or a metropolitan utilities district. Source Laws 2024, LB1074, § 3. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legisl… Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
Small businesses (sensitive-data sale ban still applies) Small businesses (federal Small Business Act, as of 2024-01-01) - except the 87-1118 ban on selling sensitive data without consent, which still applies. Archived excerpt — the text we read …Data Privacy Act applies only to a person that: (a) Conducts business in this state or produces a product or service consumed by residents of this state; (b) Processes or engages in the sale of personal data; and (c) Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section 87-1118 applies to a person described by this subdivision. (2) The Data Privacy Act does not apply to any: (a) State agency or political subdivision of this state; (b) Financial institution, affiliate of a financial institution, or data subject to Title V of the Gramm-Leach… Archived from source — captured 2026-08-15 · snapshot da8c0d96 Verify at the source
Protected health information under HIPAA Archived excerpt — the text we read 87-1104. Information and records to which act is not applicable. The Data Privacy Act does not apply to the following: (1) Protected health information under the Health Insurance Portability and Accountability Act; (2) Health records; (3) Patient identifying information for purposes of 42 U.S.C. 290dd-2, as such section existed on January 1, 2024; (4) Identifiable private information: (a) For purposes of the federal policy fo… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Health records Archived excerpt — the text we read …1104. Information and records to which act is not applicable. The Data Privacy Act does not apply to the following: (1) Protected health information under the Health Insurance Portability and Accountability Act; (2) Health records; (3) Patient identifying information for purposes of 42 U.S.C. 290dd-2, as such section existed on January 1, 2024; (4) Identifiable private information: (a) For purposes of the federal policy for the protection of h… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Patient identifying information under 42 U.S.C. 290dd-2 Archived excerpt — the text we read …d records to which act is not applicable. The Data Privacy Act does not apply to the following: (1) Protected health information under the Health Insurance Portability and Accountability Act; (2) Health records; (3) Patient identifying information for purposes of 42 U.S.C. 290dd-2, as such section existed on January 1, 2024; (4) Identifiable private information: (a) For purposes of the federal policy for the protection of human subjects under 45 C.F.R. part 46, as such part existed on January 1, 2024; (b) Collected as part of human subj… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Human subjects research information (federal policy) Archived excerpt — the text we read …ce Portability and Accountability Act; (2) Health records; (3) Patient identifying information for purposes of 42 U.S.C. 290dd-2, as such section existed on January 1, 2024; (4) Identifiable private information: (a) For purposes of the federal policy for the protection of human subjects under 45 C.F.R. part 46, as such part existed on January 1, 2024; (b) Collected as part of human subjects research under the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use, as such g… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Human subjects research data Human subjects research under good clinical practice guidelines or 21 C.F.R. parts 50 and 56. Archived excerpt — the text we read …tion existed on January 1, 2024; (4) Identifiable private information: (a) For purposes of the federal policy for the protection of human subjects under 45 C.F.R. part 46, as such part existed on January 1, 2024; (b) Collected as part of human subjects research under the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use, as such guidelines existed on January 1, 2024, or of the protection of human subjects under 21 C.F.R. parts 50 and 56, as such parts existed on January 1, 2024; or (c) That is personal data used or shared in research conducted pursuant to the Data Privacy Act or other research conducted in accordance with applicable Nebraska law; (5) Information and documents created for pur… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Personal data used in research under the Act or Nebraska law Archived excerpt — the text we read …al Requirements for Pharmaceuticals for Human Use, as such guidelines existed on January 1, 2024, or of the protection of human subjects under 21 C.F.R. parts 50 and 56, as such parts existed on January 1, 2024; or (c) That is personal data used or shared in research conducted pursuant to the Data Privacy Act or other research conducted in accordance with applicable Nebraska law; (5) Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq., as such act existed on January 1, 2024; (6) Patient safety work product for purp… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Health Care Quality Improvement Act information Archived excerpt — the text we read … as such parts existed on January 1, 2024; or (c) That is personal data used or shared in research conducted pursuant to the Data Privacy Act or other research conducted in accordance with applicable Nebraska law; (5) Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq., as such act existed on January 1, 2024; (6) Patient safety work product for purposes of the federal Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. 299b-21 et seq., as such act existed on January 1, 2024; (7) Information derived from any of t… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Patient Safety and Quality Improvement Act work product Archived excerpt — the text we read …ordance with applicable Nebraska law; (5) Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 U.S.C. 11101 et seq., as such act existed on January 1, 2024; (6) Patient safety work product for purposes of the federal Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. 299b-21 et seq., as such act existed on January 1, 2024; (7) Information derived from any of the health care-related information listed in this section that is deidentified in accordance with the requirements for deidentification under the Health Insurance Portability and A… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
HIPAA-deidentified health information Archived excerpt — the text we read …ch act existed on January 1, 2024; (6) Patient safety work product for purposes of the federal Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. 299b-21 et seq., as such act existed on January 1, 2024; (7) Information derived from any of the health care-related information listed in this section that is deidentified in accordance with the requirements for deidentification under the Health Insurance Portability and Accountability Act; (8) Information originating from, and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this section that is maintained by a covered entity or business a… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Information intermingled with exempt HIPAA information Archived excerpt — the text we read …ed from any of the health care-related information listed in this section that is deidentified in accordance with the requirements for deidentification under the Health Insurance Portability and Accountability Act; (8) Information originating from, and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this section that is maintained by a covered entity or business associate as defined by the Health Insurance Portability and Accountability Act or by a program or a qualified service organization as defined by 42 U.S.C. 290dd-2, as such section existed on January 1, 2024; (9) Information that is included in a limited data set as described by 45 C.F.R. 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified by 45 C.F.R. 164.514(e), as su… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
HIPAA limited data set Archived excerpt — the text we read …iness associate as defined by the Health Insurance Portability and Accountability Act or by a program or a qualified service organization as defined by 42 U.S.C. 290dd-2, as such section existed on January 1, 2024; (9) Information that is included in a limited data set as described by 45 C.F.R. 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified by 45 C.F.R. 164.514(e), as such regulation existed on January 1, 2024; (10) Information collected or used only for public health activities and purposes as authorized by the Health Insurance Portability and Accountability Act; (11) The coll… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Public health activities information under HIPAA Archived excerpt — the text we read … data set as described by 45 C.F.R. 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified by 45 C.F.R. 164.514(e), as such regulation existed on January 1, 2024; (10) Information collected or used only for public health activities and purposes as authorized by the Health Insurance Portability and Accountability Act; (11) The collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
FCRA-regulated data Archived excerpt — the text we read …apacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the federal Fair Credit Reporting Act, 15 U.S.C. 1681 et seq., as such act existed on January 1, 2024; (12) Personal data collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as such act existed on January 1, 2024; (13) Personal data r… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Driver's Privacy Protection Act data Archived excerpt — the text we read … by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the federal Fair Credit Reporting Act, 15 U.S.C. 1681 et seq., as such act existed on January 1, 2024; (12) Personal data collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as such act existed on January 1, 2024; (13) Personal data regulated by the federal Family Educational Rights and Privacy Act of 1974, 20 U.S.C. 1232g, as such act existed on January 1, 2024; (14) Personal data collected, processed, sold, or disclosed in c… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
FERPA-regulated data Archived excerpt — the text we read …January 1, 2024; (12) Personal data collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as such act existed on January 1, 2024; (13) Personal data regulated by the federal Family Educational Rights and Privacy Act of 1974, 20 U.S.C. 1232g, as such act existed on January 1, 2024; (14) Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act of 1971, 12 U.S.C. 2001 et seq., as such act existed on January 1, 2024; (15) Data processed or maintained in… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Farm Credit Act data Archived excerpt — the text we read …U.S.C. 2721 et seq., as such act existed on January 1, 2024; (13) Personal data regulated by the federal Family Educational Rights and Privacy Act of 1974, 20 U.S.C. 1232g, as such act existed on January 1, 2024; (14) Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act of 1971, 12 U.S.C. 2001 et seq., as such act existed on January 1, 2024; (15) Data processed or maintained in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data … Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Employment-related data Archived excerpt — the text we read … act existed on January 1, 2024; (14) Personal data collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act of 1971, 12 U.S.C. 2001 et seq., as such act existed on January 1, 2024; (15) Data processed or maintained in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role; (16) Data processed or maintained as the emergency contact information of an individual under the Data Privacy Act that is used for emergency contact purposes; or (17) Data that is processed or maintained and is nece… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Emergency contact information Archived excerpt — the text we read …vidual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role; (16) Data processed or maintained as the emergency contact information of an individual under the Data Privacy Act that is used for emergency contact purposes; or (17) Data that is processed or maintained and is necessary to retain to administer benefits for another individual that relates to an individual described by subdivision (15) of this section and used for the purpos… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Benefits administration data Archived excerpt — the text we read …llected and used within the context of that role; (16) Data processed or maintained as the emergency contact information of an individual under the Data Privacy Act that is used for emergency contact purposes; or (17) Data that is processed or maintained and is necessary to retain to administer benefits for another individual that relates to an individual described by subdivision (15) of this section and used for the purposes of administering such benefits. Source Laws 2024, LB1074, § 4. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legisl… Archived from source — captured 2026-08-15 · snapshot c4900bfa Verify at the source
Purely personal or household activity Archived excerpt — the text we read 87-1105. Personal or household activity. The Data Privacy Act does not apply to the processing of personal data by a person in the course of a purely personal or household activity. Source Laws 2024, LB1074, § 5. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legisl… Archived from source — captured 2026-08-15 · snapshot bfe95beb Verify at the source
Evidentiary privilege (compliance would violate a Nebraska evidentiary privilege) Archived excerpt — the text we read …r (iii) Are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party. (2) A requirement imposed on a controller or processor under the Data Privacy Act shall not apply if compliance with the requirement by the controller or processor, as applicable, would violate an evidentiary privilege under any law of this state. Source Laws 2024, LB1074, § 27. Frequent Questions Americans with Disabilities Act Notice Privacy Policy Glossary of Terms Contact Us Disclaimer OFFICIAL NEBRASKA GOVERNMENT WEBSITE Copyright © Nebraska Legis… Archived from source — captured 2026-08-15 · snapshot 8cb6a728 Verify at the source
Trade secrets (no obligation to disclose) Archived excerpt — the text we read …e a requirement on any controller or processor that adversely affects any right or freedom of any person, including the right of free speech pursuant to the First Amendment to the Constitution of the United States; (4) Require a controller, processor, third party, or consumer to disclose a trade secret; (5) Apply to the processing of personal data by any individual in the course of a purely personal or household activity; or (6) Prevent a controller or processor from providing personal data concerning a consumer to … Archived from source — captured 2026-08-15 · snapshot 85d731d1 Verify at the source
Privileged communications to a person covered by an evidentiary privilege Archived excerpt — the text we read …risks associated with research, including any risks associated with reidentification; or (j) Assist another controller, processor, or third party with any of the requirements under subdivision (1) of this section; (2) Prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication; (3) Impose a requirement on any controller or processor that adversely affects any right or freedom of any person, including the right of free speech pursuant to the First Amendment to the Constitution of the United St… Archived from source — captured 2026-08-15 · snapshot 85d731d1 Verify at the source
Rights and freedoms of others, including free speech Archived excerpt — the text we read …section; (2) Prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication; (3) Impose a requirement on any controller or processor that adversely affects any right or freedom of any person, including the right of free speech pursuant to the First Amendment to the Constitution of the United States; (4) Require a controller, processor, third party, or consumer to disclose a trade secret; (5) Apply to the processing of personal data by any individual in the course of a purely personal or household activity; or (… Archived from source — captured 2026-08-15 · snapshot 85d731d1 Verify at the source

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source.

Timeline

NDPA milestones

This state currently has one dated milestone on the books.

Enforcement January 1, 2025

NDPA took effect

Enforcement began — obligations have been live since this date.

Source: primary citation

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source. Reference only, not legal advice.

Status Signed Who it applies to Enforced by Maximum penalty per violation Right to cure Private right of action Universal opt-out signal Status — Privacy-law tracker Effective — Regulator guidance Private right of action — Privacy-law tracker

When staying on top of the law isn't enough, DataGrail automates the work.

DSR automation and regulatory tracking — handled by the platform behind this reference.

How DataGrail helps

Back to the Regulations Hub Reference only — not legal advice. Published Sep 29, 2026