What Is the Nebraska Data Privacy Act?
NBDPA applies to a person doing business in Nebraska or producing a product or service consumed by Nebraska residents that processes or sells personal data and is not a small business under the federal Small Business Act, subject to statutory exclusions. Small businesses remain subject to the separate sensitive-data sale-consent rule. Rights include access, correction, deletion, portability, and opt-outs from targeted advertising, sale, and certain profiling. Controllers generally have 45 days to respond, with a possible 45-day extension, and appeals are decided within 60 days. The Attorney General has exclusive enforcement authority, with a 30-day written notice-and-cure process and civil penalties up to $7,500 per violation; there is no private right of action.
At a glance
- Full name
- Nebraska Data Privacy Act
- Short code
- NBDPA
- Effective date
- January 1, 2025
- Response reference
- 45 days in this snapshot
- Cure period
- 30 days in this snapshot
- Private right of action
- No
- Enforcement
- Nebraska Attorney General. Consumer Protection Division
- Penalty reference
- Up to $7,500 in civil penalties for each violation under Neb. Rev. Stat. § 87-1124, following the statutory cure period or a breach of the written statement
- Statutory citation
- Neb. Rev. Stat. §§ 87-1101–87-1130.
Who NBDPA applies to
A business is covered if it meets the applicability thresholds set out in Neb. Rev. Stat. §§ 87-1101–87-1130.. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Conducts business in Nebraska or produces a product or service consumed by Nebraska residents, AND
- Processes or engages in the sale of personal data, AND
- Is not a small business as determined under the federal Small Business Act as it existed on January 1, 2024; small businesses remain subject to the sensitive-data sale-consent rule in § 87-1118
Consumer rights under NBDPA
Access, correct, delete, port, and opt out of targeted advertising, sale, and certain profiling
No consumer-count thresholds; product/service, non-small-business, processing/sale, and exemption tests still apply
AG exclusive enforcement; no private right of action
Notable features (vs. CCPA)
NBDPA uses a non-small-business and processing-or-sale test rather than consumer-count or revenue thresholds. The act applies to a person doing business in Nebraska or producing a product or service consumed by Nebraska residents, subject to entity and data exclusions; a small business is generally outside the act except for the separate prohibition on selling sensitive data without prior consent.
Enforcement and penalty reference
Enforcing agency: Nebraska Attorney General. Consumer Protection Division
Penalty reference: Up to $7,500 in civil penalties for each violation under Neb. Rev. Stat. § 87-1124, following the statutory cure period or a breach of the written statement
Cure period: Before bringing an action, the Attorney General must give written notice at least 30 days beforehand identifying the specific alleged provisions. No action may be brought if, within that period, the controller or processor cures the violation and provides a written cure statement with supporting documentation plus an express statement that it will not commit the violation again.
Private right of action: NBDPA has no private right of action. Enforcement is exclusive to the Nebraska Attorney General.
Where to file a complaint: Nebraska Attorney General
How to exercise your NBDPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Nebraska residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Nebraska Attorney General complaint route at https://protectthegoodlife.nebraska.gov/file-complaint. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a NBDPA privacy request, $9 one-time
FAQ
How does Nebraska's NBDPA scope work?+
The NBDPA does not use a consumer-count threshold. It generally applies when a person does business in Nebraska or produces a product or service consumed by Nebraska residents, processes or sells personal data, and is not a small business under the statutory federal definition, subject to exclusions. A small business still may not sell sensitive data without prior consumer consent under § 87-1118.
Official sources & citations
Compare with sibling state laws
NBDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: