Law / United States / 
Nebraska
Nebraska Financial Data Protection and Consumer Notification of Data Security Breach Act
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Conduct a reasonable and prompt investigation upon becoming aware of a breach of security involving a Nebraska resident's personal information.NIST Privacy FrameworkPR.PO-P7
- Notify the Nebraska Attorney General no later than when you notify the affected resident, if notice to the resident is required.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which facts show that use of a Nebraska resident's personal information for an unauthorized purpose 'is reasonably likely to occur' under Neb. Rev. Stat. § 87-803(1) when unencrypted data was acquired and no misuse has been seen?
What it makes you log
Logging duty
Section 87-803 requires an investigation when a breach is discovered, notice to each affected Nebraska resident and to the Attorney General no later than the resident notice, cooperation with the data owner, and permits a delay for law enforcement. It requires no log or record to be kept and names no audit or access to a record. Section 87-804, which the row does not cite, treats the entity's own notice procedures kept as part of an information security policy as compliance; that is a policy and not a record. Conducting business in Nebraska is the establishment hook and the notice owed to Nebraska residents is the residence hook.
- Kind
- None
- As of
What this law does
An individual or commercial entity conducting business in Nebraska that owns or licenses computerized data including personal information about a Nebraska resident must, upon becoming aware of a breach of security, conduct a reasonable and prompt investigation and, where notice is required, also notify the Attorney General no later than when notice is provided to the affected resident. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .