Law / United States / 
Nebraska
Nebraska Data Privacy Act (NDPA), Small Business Act applicability and nonprofit exemption
Neb. Rev. Stat. §§ 87-1101 to 87-1130 (Laws 2024, LB1074)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, User location
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Do not assume the NDPA applies to you based on a consumer count or revenue threshold the way other states' comprehensive privacy acts do; check whether you qualify as a small business under the federal Small Business Act as it existed on .
- The NDPA does not reach a nonprofit organization or a higher-education institution at all.
- Personal data a Nebraska consumer has not restricted to a specific audience, and that is otherwise lawfully public, falls outside the NDPA's definition of personal data.
These lines are LexLint's reading of the law's text. Also read by: Nebraska Attorney General (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://protectthegoodlife.nebraska.gov/data-privacy-homepage
- Guidance body
- Nebraska Attorney General
- Open questions
- Which federal Small Business Act definition and size standard, as that act existed on , decides whether a business is a "small business" under Neb. Rev. Stat. section 87-1103(1)(c)?
What it makes you log
Who may demand the log
Regulator
Logging duty
A controller must conduct and document a data protection assessment of processing for targeted advertising, sale, certain profiling, sensitive data and heightened-risk processing, weighing the benefits against the risks to consumers, and must make it available to the Attorney General under a civil investigative demand, who may evaluate it. The assessment is confidential and exempt from public records. No retention period is stated. Section 87-1107(6) also lets a controller that obtained data from a source other than the consumer satisfy a deletion request by retaining a record of the request.
- Kind
- Implicit
- As of
- Provision
- Neb. Rev. Stat. 87-1116(1) (conduct and document a data protection assessment), 87-1116(3) and 87-1121(2) (make it available to the Attorney General on a civil investigative demand)
- Trigger
- personal_data_processing
What this law does
Section 87-1102(28) defines publicly available information as information that is lawfully made available through government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by a consumer, or by a person to whom a consumer has disclosed the information, unless the consumer has restricted the information to a specific audience, and section 87-1102(20)(b) excludes it from personal data.
Section 87-1103(1) applies the NDPA not by a consumer-count or revenue threshold but to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, that processes or sells personal data, and that is not a small business as determined under the federal Small Business Act, as such act existed on .
Section 87-1103(2) exempts nonprofit organizations and institutions of higher education, along with state agencies and political subdivisions, financial institutions, covered entities and business associates under the federal health privacy rules, and certain electric and gas utilities. Enforcement is by the Nebraska Attorney General; there is no private right of action. The act became operative on .
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .