Nebraska’s newly passed Nebraska Data Privacy Act (NDPA) goes into effect on January 1, 2025. With the adoption of this new law, Nebraska joins the rank of states passing their own privacy laws rather than waiting for a federal one.

Overview of the Nebraska Data Privacy Act (NDPA)

Interestingly, the NDPA seems to have taken inspiration from the Texas Data Privacy and Security Act (TDPSA) for several important provisions. Highlights of the NDPA include:

• Consumer rights: consumers may request to access, amend, delete, or receive copies of their personal data, and to receive a response within 45 days.
• Opt-out: consumers have the right to opt out of their data being sold, used for targeted advertising, or processed in such a way that could affect them negatively.
• Opt-in for minors’ data: consistent with COPPA, the NDPA requires opt-in consent for any processing of a known child’s data.
• Cure period: any discovered violations must be remedied within 30 days.
• Small businesses: any company with Nebraska clients that is not defined as a small business under the federal Small Business Act is subject to the NDPA.
• DPIAs: businesses are required to conduct DPIAs for most data processing activities, especially those with a higher risk to the consumer.
• No data processing or revenue minimum: unlike most other data privacy laws, the NDPA does not include a threshold of data processed or revenue generated through data sales. This means the law encompasses more businesses than others like it.

For the most part, the NDPA reads very similarly to other state privacy laws already in effect. The primary difference is its broad applicability. Businesses under the legal threshold of data processing or revenue generation in other states may still be subject to the NDPA. If your company is in this situation, it’s time to adjust your strategy for your Nebraska clients.

Compliance with the NDPA

Businesses already compliant with other comprehensive data privacy laws may find the transition to adhering to the NDPA smoother. However, it’s crucial for companies to review the NDPA’s specific requirements to understand its implications fully.

To get a head start on complying with the NDPA and laws like it, get in touch with our team of privacy experts today.