Nebraska Data Privacy Act: Key Takeaways and Implications

Nebraska joins the ranks of states with comprehensive privacy legislation as Governor signs Nebraska Data Privacy Act into law

In a move to protect consumer data and privacy, Nebraska Governor signed the Nebraska Data Privacy Act (NDPA) into law on April 17. Nebraska now joins a growing list of states, including California, Virginia, and Colorado, that have enacted comprehensive privacy legislation.

The NDPA, which will take effect on January 1, 2025, applies to businesses operating in Nebraska or providing products or services to Nebraska residents that process or sell personal data. The law includes exemptions for nonprofits, government entities, financial institutions, and protected health information under HIPAA.

Consumers will have rights to access, delete, port, and correct their personal data under the NDPA. They will also be able to opt-out of targeted advertising, the sale of personal data, and automated profiling that could have legal or significant effects on them. The law defines the sale of personal data as the exchange of personal data for monetary or other valuable consideration.

Sensitive data, such as information revealing racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation, or genetic data, will require consent before processing. Data Protection Impact Assessments (DPIAs) will be required for processing activities involving targeted advertising, sensitive data, or other high-risk activities.

Enforcement of the NDPA will be overseen by the Nebraska Attorney General, who will have exclusive authority to enforce the law. Controllers and processors will have a 30-day right to cure any violations under the statute.

With the passage of the Nebraska Data Privacy Act, the state is taking a proactive approach to protecting consumer data and privacy in an increasingly digital world.