Nebraska NDPA
In force Nebraska · In force Jan 1, 2025 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive consumer privacy law modeled on the Texas TDPSA: consumers get access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling). Controllers must post privacy notices, obtain opt-in consent for sensitive data, honor universal opt-out signals and run data protection assessments.
- Who it applies to
- Any person that conducts business in Nebraska or produces products/services consumed by Nebraska residents, processes or sells personal data, and is not a small business as defined by the federal Small Business Act (no consumer-count threshold). Small businesses are still barred from selling sensitive data without consent (87-1118). Exempts state agencies, GLBA financial institutions, HIPAA covered entities/business associates, nonprofits, higher education, utilities.
- Penalties
- Civil penalty up to $7,500 per violation (87-1124), plus injunctive relief and AG fees/expenses. Mandatory 30-day written-notice cure period before any action (87-1122); it does not sunset. No private right of action (87-1125).
- Enforced by
- Nebraska Attorney General (exclusive)
- Official name
- Nebraska Data Privacy Act (LB 1074, 2024)
- Citation
- Neb. Rev. Stat. 87-1101 to 87-1130 (Laws 2024, LB 1074)
- Topics
- privacy
Research notes
LB 1074 was approved by the Governor on April 17, 2024 (per the Legislature's bill history). The 30-day cure right is permanent, so there is no cure-sunset deadline. Nebraska's separate Age-Appropriate Online Design Code Act (LB 504, 2025) is a different statute and not covered in this record. No amendments to the NDPA found through Sept 2026.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Nebraska NDPA
- What are the Nebraska NDPA compliance deadlines?
- Jan 1, 2025: Nebraska Data Privacy Act takes effect.
- When does Nebraska NDPA take effect?
- Nebraska NDPA took effect on Jan 1, 2025.
- Who does Nebraska NDPA apply to?
- Any person that conducts business in Nebraska or produces products/services consumed by Nebraska residents, processes or sells personal data, and is not a small business as defined by the federal Small Business Act (no consumer-count threshold). Small businesses are still barred from selling sensitive data without consent (87-1118). Exempts state agencies, GLBA financial institutions, HIPAA covered entities/business associates, nonprofits, higher education, utilities.
- What are the penalties under Nebraska NDPA?
- Civil penalty up to $7,500 per violation (87-1124), plus injunctive relief and AG fees/expenses. Mandatory 30-day written-notice cure period before any action (87-1122); it does not sunset. No private right of action (87-1125).