--- title: "Nebraska privacy law (NDPA): overview" canonical: "https://dposchool.com/state-privacy-laws/state/nebraska" source: "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Comprehensive state privacy law # Nebraska privacy law Nebraska Data Privacy Act Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) - **Citation:** Neb. Rev. Stat. §§ 87-1101 to 87-1130 - **Official text:** https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101 - **Enacted:** April 17, 2024. [Laws 2024, LB 1074, sections 1 to 30, approved by the Governor 17 April 2024](https://nebraskalegislature.gov/FloorDocs/108/PDF/Slip/LB1074.pdf) - **In force:** January 1, 2025 - **Effective dates:** - **January 1, 2025:** whole Data Privacy Act (LB 1074, section 100 makes sections 1 to 30 operative on this date) - **Enforcer:** Attorney General (exclusive) - **Private right of action:** No. The Act may not be read as a basis for a private right of action under the Act or any other law (§ 87-1125). - **Cure period:** 30 days. Before suing, the Attorney General must give written notice at least 30 days ahead. No action may be brought if the controller or processor cures within that time and gives a written statement with supporting documents plus an express statement that the violation will not recur. The cure right is permanent. (§ 87-1122) - **Rulemaking:** No. The Act grants no rulemaking power. The Attorney General must post guidance on controller, processor and consumer rights and an online complaint mechanism (§ 87-1120). ## Amendments No amendments recorded. ## Topics - [Applicability](https://dposchool.com/state-privacy-laws/state/nebraska/applicability): Nebraska uses no numeric threshold. The Act applies to any person that does business in Nebraska or produces a product or service consumed by its residents, processes or sells personal data, and is not a small business under the federal Small Business Act (the same approach as Texas). Small businesses remain bound by one rule: they may not sell sensitive data without prior consent. State agencies, GLBA financial institutions and affiliates, HIPAA covered entities and business associates, nonprofits, institutions of higher education and certain utilities are excluded at entity level, and many data types are exempt, including employment-context data. - [Consumer rights](https://dposchool.com/state-privacy-laws/state/nebraska/consumer-rights): Consumers may confirm and access their data, correct it, delete it, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and significant-effect profiling. Controllers must answer within 45 days, extendable once by 45 days with notice, and responses are free up to twice a year. Appeals must be decided in writing within 60 days, with a way to complain to the Attorney General if denied. Controllers must offer at least two request methods. - [Sensitive data](https://dposchool.com/state-privacy-laws/state/nebraska/sensitive-data): Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child (under 13), and precise geolocation within 1,750 feet. Controllers must obtain consent before processing sensitive data, and must follow COPPA for a known child. Every business, including small businesses, needs prior consent to sell sensitive data. There is no separate teen rule. - [Controller duties](https://dposchool.com/state-privacy-laws/state/nebraska/controller-duties): Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not process data for incompatible purposes without consent. The privacy notice must list data categories (including sensitive data), purposes, how to exercise and appeal rights, data and third-party categories shared, and the request methods; sale and targeted advertising must be disclosed separately. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing. Consumers may use an authorized agent, including a browser setting or global device setting, to opt out of targeted advertising and sale, subject to stated exceptions. - [Processors](https://dposchool.com/state-privacy-laws/state/nebraska/processors): Processors must follow controller instructions and help with rights requests, security and breach notification, and data protection assessments. The contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and require confidentiality, deletion or return, compliance information, assessments and written flow-down to subcontractors. A processor may instead arrange an independent assessment. - [Enforcement](https://dposchool.com/state-privacy-laws/state/nebraska/enforcement): The Attorney General has exclusive enforcement authority and may issue civil investigative demands, including for data protection assessments. A permanent 30-day cure period applies before any action. Violations after the cure period, or breach of the written statement, carry civil penalties of up to $7,500 per violation, with injunctions and fees available. There is no private right of action. ## Sources - [Neb. Rev. Stat. §§ 87-1101 to 87-1130 (statute pages with source notes)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101) - [LB 1074 (2024), slip law as approved 17 April 2024](https://nebraskalegislature.gov/FloorDocs/108/PDF/Slip/LB1074.pdf) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Nebraska statute](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101) Reference material, not legal advice. ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Nebraska Previous: [Iowa](https://dposchool.com/state-privacy-laws/state/iowa) Next: [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents