Law / United States / 
Nebraska
Nebraska Data Privacy Act (NDPA), general applicability and controller/processor duties
Neb. Rev. Stat. §§ 87-1101, 87-1107 to 87-1114
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Confirm you conduct business in Nebraska, or produce a product or service used by Nebraska residents, and process or sell personal data before relying on NDPA's scope in compliance planning.
These lines are LexLint's reading of the law's text. Also read by: Office of the Nebraska Attorney General (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://protectthegoodlife.nebraska.gov/data-privacy-homepage
- Guidance body
- Office of the Nebraska Attorney General
- Open questions
- Which size standard under the federal Small Business Act decides whether a person is a small business under Neb. Rev. Stat. § 87-1103(1)(c), and as of what date is the person measured against it?
What it makes you log
Logging duty
Sections 87-1107 to 87-1114 set consumer requests and rights, the 45-day response, the appeal process, request methods, collection limits and data security practices, the privacy notice and the sale and advertising disclosure. None requires a log or record to be kept: the controller bears the burden of demonstrating that a request is manifestly unfounded or excessive (87-1108(4)), which allocates proof about a request and is not a record duty, and retaining a record of a deletion request is one of two routes to compliance and is optional (87-1108(6)(a)). The privacy notice and the security practices are a published policy and a safeguard, not a record. The documented data protection assessment that the controller makes available to the Attorney General on a civil investigative demand sits in 87-1116 and 87-1121, and the processor's duty to make available information that demonstrates compliance in 87-1115(2)(f)(iii); the row cites neither, so neither is borrowed. The Act applies to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents (87-1103(1)(a)), and a consumer is defined as a Nebraska resident (87-1102(7)); both prongs of the applicability clause are coded as hooks and the residence definition is named here.
- Kind
- None
- As of
What this law does
NDPA governs private-sector processing of Nebraska residents' personal data. Enacted as part of omnibus Legislative Bill 1074 (108th Legislature), approved by the Governor . Sections 1 to 30 of Legislative Bill 1074 became operative on . Controller and processor duties are allocated across sections 87-1107 to 87-1114.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .