Nebraska Data Privacy Act
NDPA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Small-business exclusion model.
Core threshold: No classic consumer-count threshold; applies broadly to entities processing/selling personal data unless they qualify as a federal Small Business Act small business
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Access / confirmation | ✓ Included / qualified by statute |
| Correction | ✓ Included / qualified by statute |
| Deletion | ✓ Included / qualified by statute |
| Portability | ✓ Included / qualified by statute |
| Opt-out targeted advertising | ✓ Included / qualified by statute |
| Opt-out sale | ✓ Included / qualified by statute |
| Opt-out profiling | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Small businesses still need consent before selling sensitive data
Sensitive data includes protected child-related data under the statutory framework.
Business obligations
Controller and processor duties, privacy notices, security, consent for sensitive data and assessments for heightened-risk processing.
Enforcement
Authority: Nebraska Attorney General
Private right of action: No general private action
Penalty / remedy baseline: Attorney General enforcement under the Act
What makes Nebraska different?
Nebraska rejects the common 100,000/25,000-consumer model. Its principal scope limiter is whether the organization is a small business under the federal Small Business Act.
Developments to watch
The Attorney General maintains dedicated controller, processor and consumer guidance and complaint resources.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.