---
title: "Nebraska privacy law (NDPA): consumer rights"
canonical: "https://dposchool.com/state-privacy-laws/state/nebraska/consumer-rights"
source: "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Nebraska Data Privacy Act

# Nebraska privacy law (NDPA): consumer rights

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Consumers may confirm and access their data, correct it, delete it, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and significant-effect profiling. Controllers must answer within 45 days, extendable once by 45 days with notice, and responses are free up to twice a year. Appeals must be decided in writing within 60 days, with a way to complain to the Attorney General if denied. Controllers must offer at least two request methods.

## Key points

1. Rights: confirm and access, correct, delete, portable copy of data the consumer provided (where digital and automated), and opt out of targeted advertising, sale and significant-effect profiling.

   Section: [§ 87-1107(2)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

2. Response within 45 days; one 45-day extension if the consumer is told within the first period, with reasons.

   Section: [§ 87-1108(2)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

3. Responses free up to twice a year; manifestly unfounded, excessive or repetitive requests may be charged or refused.

   Section: [§ 87-1108(4)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

4. Appeal decided in writing within 60 days; on denial, the controller must give the online route to complain to the Attorney General.

   Section: [§ 87-1109](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

5. At least two secure and reliable request methods; no new account may be required.

   Section: [§ 87-1111(1) and (2)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

6. Contract terms that waive or limit these rights are void.

   Section: [§ 87-1110](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

## Sources

- [https://nebraskalegislature.gov/laws/statutes.php?statute=87-1107](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1107)
- [https://nebraskalegislature.gov/laws/statutes.php?statute=87-1108](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1108)

[Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access)
- [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion)
- [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Nebraska statute](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

Reference material, not legal advice.

## Other topics for Nebraska

- [Applicability](https://dposchool.com/state-privacy-laws/state/nebraska/applicability)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/nebraska/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/nebraska/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/nebraska/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/nebraska/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska) / Consumer rights

Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/nebraska/applicability)

Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/nebraska/sensitive-data)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents