The Nebraska Data Privacy Act (NDPA), enacted on April 17, 2024, marks a significant step toward comprehensive consumer data protection in Nebraska. It joins a growing list of states implementing privacy-focused legislation.Â
The NDPA applies to entities that do business in Nebraska or offer products/services to its residents, process or sell personal data, and are not classified as small businesses under the federal Small Business Act as of January 1, 2024. It empowers data subjects with multiple rights, such as the right to confirm and access information, correct, delete, portability, and opt out of processing.
The NDPA, scheduled to take effect on January 1, 2025, establishes robust requirements for businesses handling personal data. Provisions address data minimization and purpose limitation, privacy policy, consent, security measures, nondiscrimination, data protection assessment, and more. Non-compliance with the NDPA can result in a civil penalty of up to $7,500 per violation.