Law note · Nebraska

Nebraska Data Privacy Act (NDPA), Small Business Act applicability and nonprofit exemption

cite Neb. Rev. Stat. §§ 87-1101 to 87-1130 (Laws 2024, LB1074) stage IN FORCE in force since 2025-01-01 kind Personal data binds private bodies reviewed 2026-08-29

What it asks of an app

Do not assume the NDPA applies to you based on a consumer count or revenue threshold the way other states' comprehensive privacy acts do; check whether you qualify as a small business under the federal Small Business Act as it existed on January 1, 2024.
The NDPA does not reach a nonprofit organization or a higher-education institution at all, a broader categorical exemption than several peer states carry.
Personal data a Nebraska consumer has not restricted to a specific audience, and that is otherwise lawfully public, falls outside the NDPA's definition of personal data.

When LexLint raises it

crawls_web
trains_models
processes_biometrics

What we found

Section 87-1102(28) excludes information lawfully made available through government records, or that a business has a reasonable basis to believe was lawfully made available to the public through widely distributed media, by a consumer, or by someone the consumer disclosed it to, unless the consumer has restricted the information to a specific audience, from the Act's definition of personal data.

Unusually, section 87-1103(1) applies the NDPA not by a consumer-count or revenue threshold but to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, that processes or sells personal data, and that is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, tying Nebraska's coverage to federal size standards that vary by industry rather than a fixed number.

Section 87-1103(2) exempts nonprofit organizations and institutions of higher education outright, beyond the standard state-agency, financial-institution, and HIPAA-covered-entity carve-outs, a broader nonprofit exemption than several peer states carry. Effective January 1, 2025, confirmed on the Nebraska Attorney General's official Data Privacy homepage. Enforcement is by the Nebraska Attorney General; there is no private right of action.

Primary source

official text, Nebraska Legislature (nebraskalegislature.gov)
effective date confirmed on the Nebraska Attorney General's official Data Privacy homepage (protectthegoodlife.nebraska.gov)

← Back to the example · Lint your app →