# Nebraska — US state consumer data privacy laws: applicability thresholds by state

For Nebraska, law name and abbreviation is Nebraska Data Privacy Act (NDPA); effective date is January 1, 2025; threshold combination logic is No numeric consumer or revenue thresholds — applies to any non-small-business that processes or sells personal data; key exemptions is Small businesses as determined under the federal Small Business Act; state agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; electric suppliers; natural gas public utilities; enforcement mechanism is Attorney General; 30-day cure period; civil penalty up to $7,500 per violation; no private right of action, recorded from its source on 2026-08-12.

- **State:** Nebraska _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Nebraska Data Privacy Act (NDPA)
- **Effective date:** January 1, 2025
- **Threshold combination logic:** No numeric consumer or revenue thresholds — applies to any non-small-business that processes or sells personal data
- **Key exemptions:** Small businesses as determined under the federal Small Business Act; state agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; electric suppliers; natural gas public utilities
- **Enforcement mechanism:** Attorney General; 30-day cure period; civil penalty up to $7,500 per violation; no private right of action
- **Statute citation:** Neb. Rev. Stat. §§ 87-1101 to 87-1118
- **Notes:** Nebraska follows the Texas model rather than the Virginia model, using the federal Small Business Act to determine applicability rather than fixed numeric thresholds. Nebraska is the only other state besides Texas to take this approach.

## What the source says

> Data Privacy Act applies only to a person that: (a) Conducts business in this state or produces a product or service consumed by residents of this state; (b) Processes or engages in the sale of personal data; and (c) Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section

## Source

- https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).