Nebraska Data Privacy Act (NDPA), Small Business Act applicability and nonprofit exemption

Neb. Rev. Stat. §§ 87-1101 to 87-1130 (Laws 2024, LB1074)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 January 2025.

A personal data rule binding private bodies.

As of 29 August 2026.

What it requires

Do not assume the NDPA applies to you based on a consumer count or revenue threshold the way other states' comprehensive privacy acts do; check whether you qualify as a small business under the federal Small Business Act as it existed on January 1, 2024.
The NDPA does not reach a nonprofit organization or a higher-education institution at all, a broader categorical exemption than several peer states carry.
Personal data a Nebraska consumer has not restricted to a specific audience, and that is otherwise lawfully public, falls outside the NDPA's definition of personal data.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 87-1102(28) excludes information lawfully made available through government records, or that a business has a reasonable basis to believe was lawfully made available to the public through widely distributed media, by a consumer, or by someone the consumer disclosed it to, unless the consumer has restricted the information to a specific audience, from the Act's definition of personal data.

Unusually, section 87-1103(1) applies the NDPA not by a consumer-count or revenue threshold but to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, that processes or sells personal data, and that is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, tying Nebraska's coverage to federal size standards that vary by industry rather than a fixed number.

Section 87-1103(2) exempts nonprofit organizations and institutions of higher education outright, beyond the standard state-agency, financial-institution, and Health Insurance Portability and Accountability Act (HIPAA)-covered-entity carve-outs, a broader nonprofit exemption than several peer states carry. Effective January 1, 2025, confirmed on the Nebraska Attorney General's official Data Privacy homepage. Enforcement is by the Nebraska Attorney General; there is no private right of action.

When LexLint raises it

crawls_web
trains_models
processes_biometrics

Read the law

official text, Nebraska Legislature (nebraskalegislature.gov)
effective date confirmed on the Nebraska Attorney General's official Data Privacy homepage (protectthegoodlife.nebraska.gov)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app