Support Centre



Law: Nebraska Data Privacy Act (NDPA)

Regulator: The Nebraska Attorney General (AG)

Summary: The NDPA was approved by the Governor of Nebraska on April 18, 2024, and will enter into effect on January 1, 2025. The NDPA marks the State's first comprehensive privacy legislation and includes consumer rights, including the right to opt out of the processing of personal data for the purposes of targeted advertising, sale of personal data, or profiling. The NDPA further lays down controller and processor obligations, including the requirement for a controller to conduct data protection assessment in certain circumstances. The AG is granted the exclusive authority to enforce the provisions of the NDPA and does not provide for a private right of action.

Additionally, data security and breach notification requirements are governed under §§87-801 et seq. of Chapter 87 of the Nebraska Revised Statutes. Moreover, Nebraska's Financial Data Protection and Consumer Notification of Data Security Breach Act regulates the notification of breaches of consumer data, with the AG responsible for enforcing these provisions and competent to issue subpoenas and recover direct economic damages for each resident injured by the violation of these provisions.


Three states - Kentucky, Maryland, and Nebraska - welcomed Spring 2024 by passing comprehensive consumer privacy laws, joining the laws in New Hampshire and New Jersey1 enacted earlier this year. With the five new laws enacted in early Q2 2024, more than one-third of states have consumer privacy laws on the books.

In this part one Insight article, Julia Jacobson, Alexandra Kiosse, and Alan Friel, from Squire Patton Boggs, answer common questions such as the scope of protection, effective dates, and applicability, about the three newest state consumer privacy laws.

In this Insight article, Maureen Fulton and Mikaela Witherspoon, from Koley Jessen P.C., L.L.O., delve into Nebraska's recently passed Data Privacy Act (NDPA), exploring its key provisions and similarities with the Texas Data Privacy and Security Act (TDPSA).