Nebraska
For Nebraska, law name and abbreviation is Nebraska Data Privacy Act (NDPA); effective date is January 1, 2025; threshold combination logic is No numeric consumer or revenue thresholds — applies to any non-small-business that processes or sells personal data; key exemptions is Small businesses as determined under the federal Small Business Act; state agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; electric suppliers; natural gas public utilities; enforcement mechanism is Attorney General; 30-day cure period; civil penalty up to $7,500 per violation; no private right of action, recorded from its source on 2026-08-12.
- State
- Nebraska our reading
- Law name and abbreviation
- Nebraska Data Privacy Act (NDPA)
- Effective date
- January 1, 2025
- Threshold combination logic
- No numeric consumer or revenue thresholds — applies to any non-small-business that processes or sells personal data
- Key exemptions
- Small businesses as determined under the federal Small Business Act; state agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; electric suppliers; natural gas public utilities
- Enforcement mechanism
- Attorney General; 30-day cure period; civil penalty up to $7,500 per violation; no private right of action
- Statute citation
- Neb. Rev. Stat. §§ 87-1101 to 87-1118
- Notes
- Nebraska follows the Texas model rather than the Virginia model, using the federal Small Business Act to determine applicability rather than fixed numeric thresholds. Nebraska is the only other state besides Texas to take this approach.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
Data Privacy Act applies only to a person that: (a) Conducts business in this state or produces a product or service consumed by residents of this state; (b) Processes or engages in the sale of personal data; and (c) Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section
— nebraskalegislature.gov, retrieved 2026-08-12
Source
- nebraskalegislature.govhttps://nebraskalegislature.gov/laws/statutes.php?statute=87-1103