{ "type": "practice-guide", "canonical": "https://openagreements.org/practice-guides/privacy/us/nebraska", "links": [ { "rel": "self", "href": "https://openagreements.org/practice-guides/privacy/us/nebraska.json", "type": "application/json" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/nebraska", "type": "text/html" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/nebraska/markdown", "type": "text/markdown" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/nebraska/json", "type": "application/json" } ], "data": { "topic": "privacy", "state": "nebraska", "frontmatter": { "title": "Nebraska Consumer Privacy Law (Data Privacy Act)", "description": "The Nebraska Data Privacy Act gives Nebraska consumers rights over their personal data and imposes notice, contracting, and consent duties on most for-profit businesses — unusually, it uses no consumer-volume or revenue threshold and instead exempts only federal small businesses, and it is enforced exclusively by the Attorney General with a 30-day cure period and no private right of action.", "state": "Nebraska", "lastReviewed": "2026-06-06", "license": "CC BY 4.0", "authors": [ "steven-obiajulu" ], "summary": { "keyLaw": "Neb. Rev. Stat. §§ 87-1101 et seq. (Nebraska Data Privacy Act, effective Jan. 1, 2025)", "appliesTo": "Persons that conduct business in Nebraska or produce a product or service consumed by Nebraska residents, that process or sell personal data, and that are not a small business under the federal Small Business Act — no consumer-count or revenue threshold; state agencies, GLBA, HIPAA, nonprofits, and higher-education institutions exempt", "privacyPolicyRequired": "Yes — a reasonably accessible and clear privacy notice with statutorily fixed contents", "privateRightOfAction": "No — the Act cannot be construed as a basis for a private right of action", "regulator": "Nebraska Attorney General (exclusive)", "bottomLine": "If you do business in Nebraska (or serve its residents), process or sell personal data, and are not a federal small business, the Data Privacy Act requires a privacy notice, opt-in consent to process sensitive data, and processor contracts — enforced by the Attorney General with a 30-day cure period and no consumer lawsuits.", "lawCoverage": "comprehensive", "policyMandate": "statutoryContents", "consumersCanSue": "no", "sensitiveDataConsent": "optIn", "universalOptOutSignal": "notRequired" }, "about": [ "Nebraska Data Privacy Act NDPA", "Nebraska privacy policy requirements", "Nebraska privacy notice contents", "Nebraska Data Privacy Act applicability small business", "Nebraska Data Privacy Act sensitive data consent", "Nebraska Data Privacy Act processor contract requirements", "Nebraska Attorney General privacy enforcement", "Nebraska Data Privacy Act no private right of action" ], "translations": [ { "language": "中文", "status": "planned" }, { "language": "Español", "status": "planned" }, { "language": "Português", "status": "planned" }, { "language": "Deutsch", "status": "planned" } ] }, "questions": [ { "slug": "does-ndpa-apply", "label": "Does the Nebraska Data Privacy Act apply to your business?", "heading": "Does the Nebraska Data Privacy Act apply to your business?", "answerText": "It turns on whether you are a small business, not on how many consumers you reach. The Act applies to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, that processes or sells personal data, and that is not a small business as determined under the federal Small Business Act.", "sources": [ { "id": "stat-1103-apply", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Neb. Rev. Stat. § 87-1103", "citation": "Neb. Rev. Stat. § 87-1103(1).", "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103", "proposition": "The Data Privacy Act applies only to a person that conducts business in Nebraska or produces a product or service consumed by its residents, processes or sells personal data, and is not a small business under the federal Small Business Act.", "verbatimQuote": "The Data Privacy Act applies only to a person that: (a) Conducts business in this state or produces a product or service consumed by residents of this state; (b) Processes or engages in the sale of personal data; and (c) Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section 87-1118 applies to a person described by this subdivision.", "anchor": "https://openagreements.org/practice-guides/privacy/us/nebraska#src-stat-1103-apply" } ] }, { "slug": "privacy-policy-contents", "label": "What must your Nebraska privacy policy contain?", "heading": "What must your Nebraska privacy policy contain?", "answerText": "A controller must give each consumer a reasonably accessible and clear privacy notice that lists the categories of personal data processed, the purpose for processing, how a consumer exercises their rights, any categories of personal data shared with third parties, any categories of those third parties, and a description of each method for submitting a rights request.", "sources": [ { "id": "stat-1113-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Neb. Rev. Stat. § 87-1113", "citation": "Neb. Rev. Stat. § 87-1113.", "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1113", "proposition": "A controller must provide each consumer a reasonably accessible and clear privacy notice listing the categories of personal data processed, the purpose for processing, how to exercise consumer rights, any categories of personal data shared with third parties, any categories of those third parties, and a description of each method for submitting a rights request.", "verbatimQuote": "A controller shall provide each consumer with a reasonably accessible and clear privacy notice that includes: (1) The categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller; (2) The purpose for processing personal data; (3) How a consumer may exercise a consumer right under sections 87-1107 to 87-1111, including the process by which a consumer may appeal a controller's decision with regard to the consumer's request; (4) If applicable, any category of personal data that the controller shares with any third party; (5) If applicable, any category of third party with whom the controller shares personal data; and (6) A description of each method required under section 87-1111 through which a consumer may submit a request to exercise a consumer right under the Data Privacy Act.", "anchor": "https://openagreements.org/practice-guides/privacy/us/nebraska#src-stat-1113-notice" } ] }, { "slug": "vendor-contracts", "label": "What must your contracts with processors say?", "heading": "What must your contracts with processors say?", "answerText": "A contract between a controller and a processor must govern the processor's data processing procedures for work done on the controller's behalf — so a data processing agreement is a statutory requirement, not just a best practice.", "sources": [ { "id": "stat-1115-contract", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Neb. Rev. Stat. § 87-1115", "citation": "Neb. Rev. Stat. § 87-1115(2).", "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1115", "proposition": "A contract between a controller and a processor must govern the processor's data processing procedures and must include clear processing instructions, the nature and purpose of processing, the type of data and duration, the rights and obligations of both parties, and a requirement that the processor maintain confidentiality, delete or return data, demonstrate compliance, cooperate with reasonable assessments, and bind subcontractors by written contract.", "verbatimQuote": "A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller. The contract shall include: (a) Clear instructions for processing data; (b) The nature and purpose of processing; (c) The type of data subject to processing; (d) The duration of processing; (e) The rights and obligations of both parties; and (f) A requirement that the processor shall: (i) Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data; (ii) At the controller's direction, delete or return all personal data to the controller as requested after the provision of the service is completed, unless retention of the personal data is required by law; (iii) Make available to the controller, on reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the requirements of the Data Privacy Act; (iv) Allow, and cooperate with, reasonable assessments by the controller or the controller's designated assessor; and (v) Engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the requirements of the processor with respect to the personal data.", "anchor": "https://openagreements.org/practice-guides/privacy/us/nebraska#src-stat-1115-contract" } ] }, { "slug": "sensitive-data", "label": "Do you need consent to process sensitive data?", "heading": "Do you need consent to process sensitive data?", "answerText": "Yes. A controller may not process a consumer's sensitive data without obtaining the consumer's consent, and for a known child it must instead handle that data in accordance with the federal Children's Online Privacy Protection Act. Sensitive data includes personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; personal data collected from a known child; and precise geolocation data.", "sources": [ { "id": "stat-1112-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Neb. Rev. Stat. § 87-1112", "citation": "Neb. Rev. Stat. § 87-1112(2)(d).", "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1112", "proposition": "A controller may not process a consumer's sensitive data without obtaining consent, and must handle a known child's sensitive data in accordance with COPPA.", "verbatimQuote": "Process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the federal Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq., as such act existed on January 1, 2024.", "anchor": "https://openagreements.org/practice-guides/privacy/us/nebraska#src-stat-1112-consent" } ] }, { "slug": "consumer-lawsuit", "label": "Can a consumer sue your business under the Data Privacy Act?", "heading": "Can a consumer sue your business under the Data Privacy Act?", "answerText": "No. The Act expressly cannot be construed as a basis for a private right of action, so consumers cannot sue under it — enforcement runs through the Attorney General. Before bringing an action, the Attorney General must give written notice at least 30 days in advance identifying the specific provisions allegedly violated, and may not sue if the business cures within that window.", "sources": [ { "id": "stat-1125-noprivate", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Neb. Rev. Stat. § 87-1125", "citation": "Neb. Rev. Stat. § 87-1125.", "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1125", "proposition": "The Data Privacy Act cannot be construed as providing a basis for a private right of action.", "verbatimQuote": "The Data Privacy Act shall not be construed as providing a basis for, or being subject to, a private right of action for a violation of the Data Privacy Act or any other law.", "anchor": "https://openagreements.org/practice-guides/privacy/us/nebraska#src-stat-1125-noprivate" }, { "id": "stat-1122-cure", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Neb. Rev. Stat. § 87-1122", "citation": "Neb. Rev. Stat. § 87-1122.", "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1122", "proposition": "Before bringing an action, the Attorney General must give written notice at least 30 days in advance identifying the specific provisions allegedly violated, and may not sue if the violation is cured within that period.", "verbatimQuote": "Before bringing an action under section 87-1124, the Attorney General shall notify a controller or processor in writing, not later than the thirtieth day before bringing the action, identifying the specific provisions of the Data Privacy Act the Attorney General alleges have been or are being violated.", "anchor": "https://openagreements.org/practice-guides/privacy/us/nebraska#src-stat-1122-cure" } ] } ] } }