---
title: "Nebraska privacy law (NDPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/nebraska/processors"
source: "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Nebraska Data Privacy Act

# Nebraska privacy law (NDPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Processors must follow controller instructions and help with rights requests, security and breach notification, and data protection assessments. The contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and require confidentiality, deletion or return, compliance information, assessments and written flow-down to subcontractors. A processor may instead arrange an independent assessment.

## Key points

1. Processors must assist with rights requests, security and breach notification, and assessments.

   Section: [§ 87-1115(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

2. The contract must include instructions, nature and purpose, data types, duration, and both parties' rights and obligations.

   Section: [§ 87-1115(2)(a) to (e)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

3. Required processor duties: confidentiality, deletion or return, compliance information on request, cooperation with assessments, and written flow-down contracts with subcontractors.

   Section: [§ 87-1115(2)(f)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

4. Alternatively, the processor may arrange a qualified independent assessment and give the report to the controller on request.

   Section: [§ 87-1115(3)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

5. Controller or processor status is a fact-based determination.

   Section: [§ 87-1115(5)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

## Sources

- [https://nebraskalegislature.gov/laws/statutes.php?statute=87-1115](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1115)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Nebraska statute](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

Reference material, not legal advice.

## Other topics for Nebraska

- [Applicability](https://dposchool.com/state-privacy-laws/state/nebraska/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/nebraska/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/nebraska/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/nebraska/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/nebraska/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/nebraska/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/nebraska/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents