What Is the Nebraska Data Privacy Act?
NBDPA applies to any business that is not a small business under SBA size standards and processes or sells Nebraska consumers' data. Unlike peer state laws, NBDPA does not use consumer-count thresholds, reaching more brokers. Rights include delete, access, correct, port, and opt-out. Enforcement is exclusive to the AG with a 30-day cure period.
At a glance
- Full name
- Nebraska Data Privacy Act
- Short code
- NBDPA
- Effective date
- January 1, 2025
- Response deadline
- 45 days
- Cure period
- None (sunset)
- Private right of action
- No
- Enforcement
- Nebraska Attorney General — Consumer Protection Division
- Maximum penalty
- Up to $7,500 per violation under the Nebraska Consumer Protection Act
- Statutory citation
- Neb. Rev. Stat. § 87-1101 et seq.
Who NBDPA applies to
A business is covered if it meets the applicability thresholds set out in Neb. Rev. Stat. § 87-1101 et seq.. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Conducts business in Nebraska or produces products/services targeted at Nebraska residents, AND
- Processes or engages in the sale of personal data, AND
- Is not a small business as defined by the US Small Business Administration (small businesses are exempt unless they sell sensitive personal data without consent)
Consumer rights under NBDPA
Delete, access, correct, port, opt-out
No consumer-count thresholds — broader broker coverage
AG exclusive enforcement
Notable features (vs. CCPA)
NBDPA uses the SBA small-business exemption model pioneered by Texas — eliminating revenue/consumer thresholds in favor of a size-based test. This means the law covers a different universe of businesses than CCPA-style threshold laws: any non-small business operating in Nebraska is potentially covered, even if it processes relatively small data volumes.
Enforcement & penalties
Enforcing agency: Nebraska Attorney General — Consumer Protection Division
Maximum penalty: Up to $7,500 per violation under the Nebraska Consumer Protection Act
Cure period: The 30-day cure period sunset on July 1, 2026. Violations after that date are directly enforceable without a cure opportunity.
Private right of action: NBDPA has no private right of action. Enforcement is exclusive to the Nebraska Attorney General.
Where to file a complaint: Nebraska Attorney General
How to exercise your NBDPA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 300+ known brokers and applies NBDPA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a Nebraska resident (e.g., ZIP code, email associated with your record).
- 3
Under NBDPA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the Nebraska Attorney General at https://protectthegoodlife.nebraska.gov/file-complaint.
Use your rights
NBDPA-compliant deletion emails, $5 one-time
OfflistMe drafts NBDPA-compliant deletion emails for 300+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $5 →FAQ
Why does Nebraska's law cover more brokers?+
Most state privacy laws apply only above consumer-count thresholds (typically 100,000). Nebraska's NBDPA skips those thresholds and applies to any non-small-business that processes Nebraska consumer data. Small brokers that escape peer state laws fall within NBDPA scope.
Official sources & citations
Compare with sibling state laws
NBDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date — useful when tracking how this law influenced or was influenced by neighbouring legislation: