Law / United States / 
Nebraska
Nebraska Data Privacy Act, consumer rights
In force since .
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Give a Nebraska consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.
These lines are LexLint's reading of the law's text. Also read by: Office of the Nebraska Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://protectthegoodlife.nebraska.gov/rights-consumers
- Guidance body
- Office of the Nebraska Attorney General
- Open questions
- What counts as 'commercially reasonable efforts' to authenticate a consumer request under Neb. Rev. Stat. § 87-1108(5), and how much additional information may a controller demand as 'reasonably necessary' to authenticate the consumer and the request?
What it makes you log
Logging duty
Section 87-1108 sets the 45-day response, the written justification for declining a request, the free response twice a year, authentication, and the deletion shortcut. The controller bears the burden of demonstrating that a request is manifestly unfounded, excessive or repetitive (87-1108(4)), which allocates proof about a request and is not a record duty. Retaining a record of a deletion request is one of two routes to compliance for data obtained from another source (87-1108(6)(a)) and is optional. A consumer's access to their own data under 87-1107 is access to the data, not to a log. The Act applies to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents (87-1103(1)(a)), and a consumer is defined as a Nebraska resident (87-1102(7)); both prongs of the applicability clause are coded as hooks and the residence definition is named here.
- Kind
- None
- As of
What this law does
The Nebraska Data Privacy Act gives a consumer the rights to access, correct and delete personal data, to obtain a portable copy, and to opt out of targeted advertising, sale and qualifying profiling. A controller must respond without undue delay and within 45 days after receipt of the request, with one 45-day extension available.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .