Nebraska Data Privacy Act (LB 1074; Neb. Rev. Stat. 87-1101 to 87-1130)
Below is what the official text of Nebraska Data Privacy Act (LB 1074; Neb. Rev. Stat. 87-1101 to 87-1130) states about whom it covers, when it applies to a business and since when. Where the pages we read do not say, the row says "not stated".
The wording shown is taken from the official page named in each row. The duties of a business and the contents of a privacy notice are in the paid checklist.
Typical situations, run through the same conditions as the check
- A for-profit US business with 150,000 people in Nebraska and $30 million revenue: Applies, or may apply: conditions to check.
- The same business with 8,000 people in Nebraska: Applies, or may apply: conditions to check.
- A US business with no users in Nebraska: Not triggered by these answers.
Judged on 2026-10-06. Our law data was last verified on 2026-10-06; a law that took effect after that date is not in it. These situations leave other answers blank or neutral: use the check for your own.
What the official text states
| Question | What the official text states | Source |
|---|---|---|
| What it covers | The Data Privacy Act (Neb. Rev. Stat. 87-1101 to 87-1130) gives Nebraska residents rights over their personal data and sets responsibilities for businesses that control or process it, enforced by the Attorney General.Official wordingthe Attorney General is required to provide information that helps businesses and consumers understand their rights and responsibilities under the Data Privacy Act, Neb. Rev. Stat. §§ 87-1101 to 87-1130. | protectthegoodlife.nebraska.gov read 2026-10-06 |
| When it applies to a business | Applies to any person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, processes or sells personal data, and is not a small business under the federal Small Business Act as it existed on January 1, 2024. No consumer-count threshold. Conditions to check: Small-business test is the federal Small Business Act definition (as of Jan. 1, 2024), which our questions cannot express: a business that is a small business is outside the Act except that it may still be liable for penalties if it sells sensitive data without the consumer's consent. The business must process or sell personal data. Neb. Rev. Stat. 87-1103 lists excluded businesses and organizations and 87-1104 to 87-1106 excluded information and uses; those sections were not read, so whether nonprofits, government bodies, financial institutions or HIPAA entities are excluded is not stated here. Source is the Attorney General's guidance page, not the statute text. Official wordingConducts business in this state or produces a product or service consumed by residents of this state; Processes or engages in the sale of personal data; AND Is not a small business as determined under the federal Small Business Act as it existed on January 1, 2024. | protectthegoodlife.nebraska.gov read 2026-10-06 |
| In force from | 2025-01-01 Attorney General guidance: as of January 1, 2025, controllers are required to take the described steps. LB 1074 was approved April 17, 2024 (per search listing; slip law not fetched). Official wordingAs of January 1 st , 2025, controllers are required to take certain steps to help consumers maintain control over their personal data. | protectthegoodlife.nebraska.gov read 2026-10-06 |
| Privacy notice | Included in the paid checklist. See the checklist | — |
| Consent and opt-out | Included in the paid checklist. See the checklist | — |
| Rights of individuals | Included in the paid checklist. See the checklist | — |
| Data protection officer | Not stated on the official pages we read. the text we read does not say whether a data protection officer must be appointed | — |
| Breach notification | Not stated on the official pages we read. separate breach-notification statute not read | — |
| What the privacy notice must contain | Included in the paid checklist. See the checklist | — |
What we do not cover
These areas are outside this site, so nothing on this page says anything about them:
- Privacy laws for particular sectors (for example health care, banking and credit, education)
- Rules specific to children's online privacy
- Cookie and electronic-communications rules (including consent for cookies and marketing messages)
- Employee, job applicant and contractor data
- Rules on sending personal data to other countries
- US state data-breach notification laws (a separate set of state laws)
- US state privacy laws that are not yet in force, and state laws on particular topics (for example biometric or health data)
- Privacy laws of countries that are not listed here
- Planned changes to the laws listed here