Law / United States / 
Nebraska
Nebraska Data Privacy Act (NDPA), data protection assessments
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to any consumer, each processing of sensitive data, and any other processing activity that presents a heightened risk of harm to any consumer.
- Make each assessment weigh the direct or indirect benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in deidentified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
- Make an assessment requested under section 87-1121 available to the Attorney General pursuant to a civil investigative demand.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment of targeted advertising, the sale of personal data, risky profiling, the processing of sensitive data and any processing activity that presents a heightened risk of harm to any consumer (87-1116(1)), and the assessment must weigh the benefits of the processing against the risks to the consumer's rights (87-1116(2)). The controller must make an assessment requested under section 87-1121(2) available to the Attorney General pursuant to a civil investigative demand (87-1116(3)); assessments are confidential and exempt from disclosure as a public record (87-1116(4)). The section sets no period for keeping an assessment. The section has no scope clause; the reach and the consumer definition are in 87-1102 and 87-1103, which this row does not cite. The processor's duty to give the controller the information to conduct and document assessments, and to make available the information that shows its compliance, is in 87-1115, also outside this row.
- Kind
- Explicit
- As of
- Provision
- Neb. Rev. Stat. 87-1116(1)-(3)
- Trigger
- personal_data_processing
What this law does
NDPA requires a controller to conduct and document a data protection assessment of each of these processing activities involving personal data: targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to any consumer, the processing of sensitive data, and any processing activity that presents a heightened risk of harm to any consumer.
Each assessment must identify and weigh the direct or indirect benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards, and must factor in the use of deidentified data, the reasonable expectations of consumers, the context of the processing and the relationship between the controller and the consumer.
A controller must make an assessment requested under section 87-1121 available to the Attorney General pursuant to a civil investigative demand under that section. An assessment is confidential and exempt from disclosure as a public record, and disclosing one in compliance with a request from the Attorney General does not waive attorney-client privilege or work-product protection.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or makes high-risk automated decisions.