Law / United States / 
Nebraska
Nebraska Data Privacy Act, Attorney General enforcement
Neb. Rev. Stat. §§ 87-1119, 87-1122, 87-1124, 87-1125
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Expect NDPA violations to be enforced exclusively by the Nebraska Attorney General, never by a private plaintiff.
- Cure an identified violation and provide the required written statement within 30 days of Attorney General notice to avoid an enforcement action.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Is each affected consumer, each unlawful act of processing, or each provision breached one 'violation' for the civil penalty of not more than $7,500 under Neb. Rev. Stat. § 87-1124(1)?
What it makes you log
Logging duty
The cited sections give the Attorney General exclusive enforcement authority (87-1119), a 30-day written notice with a cure right (87-1122), a civil penalty up to $7,500 per violation (87-1124) and no private right of action (87-1125). A controller that cures provides a written statement and supportive documentation to the Attorney General to avoid an action, which is a condition of the cure defense and not a standing duty to keep a record. The Attorney General's power to demand a data protection assessment by civil investigative demand is in 87-1121 and the assessment itself in 87-1116; the row cites neither, so audit expectation is not borrowed from them. The Act applies to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents (87-1103(1)(a)), and a consumer is defined as a Nebraska resident (87-1102(7)); both prongs of the applicability clause are coded as hooks and the residence definition is named here.
- Kind
- None
- As of
What this law does
The Nebraska Attorney General has exclusive authority to enforce NDPA. Before bringing an action, the Attorney General must give a controller or processor 30 days' written notice identifying the specific provisions violated; no sunset date for this cure right appears in the text read, unlike Connecticut's and Delaware's time-limited cure windows or Montana's eliminated one. Civil penalties run up to $7,500 per violation, and the Act creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .