---
title: "Nebraska privacy law (NDPA): controller duties"
canonical: "https://dposchool.com/state-privacy-laws/state/nebraska/controller-duties"
source: "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Nebraska Data Privacy Act

# Nebraska privacy law (NDPA): controller duties

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not process data for incompatible purposes without consent. The privacy notice must list data categories (including sensitive data), purposes, how to exercise and appeal rights, data and third-party categories shared, and the request methods; sale and targeted advertising must be disclosed separately. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing. Consumers may use an authorized agent, including a browser setting or global device setting, to opt out of targeted advertising and sale, subject to stated exceptions.

## Key points

1. Collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes; reasonable security required.

   Section: [§ 87-1112(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

2. Privacy notice: data categories including sensitive data, purposes, how to exercise and appeal rights, categories of data shared and of third parties, and each request method.

   Section: [§ 87-1113](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

3. Sale and targeted advertising must be disclosed clearly and conspicuously with how to opt out.

   Section: [§ 87-1114](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

4. Data protection assessments required for targeted advertising, sale, risky profiling, sensitive data and any heightened-risk processing.

   Section: [§ 87-1116(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

5. Opt-out through an authorized agent using a technology such as a browser setting or global device setting must be honoured if the controller can verify the consumer and agent, unless the request is unclear, residency cannot be verified, the controller cannot process it, or it does not process similar requests under other states' laws.

   Section: [§ 87-1111(5) and (6)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

6. A website must offer a way to submit requests; an online-only controller with a direct relationship may offer only an email address.

   Section: [§ 87-1111(3) and (4)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

## Sources

- [https://nebraskalegislature.gov/laws/statutes.php?statute=87-1111](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1111)
- [https://nebraskalegislature.gov/laws/statutes.php?statute=87-1112](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1112)
- [https://nebraskalegislature.gov/laws/statutes.php?statute=87-1116](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1116)

[Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Nebraska statute](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

Reference material, not legal advice.

## Other topics for Nebraska

- [Applicability](https://dposchool.com/state-privacy-laws/state/nebraska/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/nebraska/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/nebraska/sensitive-data)
- [Processors](https://dposchool.com/state-privacy-laws/state/nebraska/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/nebraska/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska) / Controller duties

Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/nebraska/sensitive-data)

Next: [Processors](https://dposchool.com/state-privacy-laws/state/nebraska/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents