Nebraska Privacy & Accessibility Laws

Nebraska enacted the Nebraska Data Privacy Act (NDPA) in April 2024, becoming one of the states with comprehensive consumer privacy legislation. The law takes effect January 1, 2025. Nebraska state agencies must also ensure their digital services are accessible to individuals with disabilities.

Nebraska Data Privacy Act (NDPA)

The NDPA establishes privacy rights for Nebraska consumers and obligations for businesses that process personal data.

Who Must Comply?

The NDPA applies to entities that conduct business in Nebraska or target Nebraska residents AND:

Threshold	Requirement
All Businesses	The NDPA applies to all businesses that process personal data of Nebraska consumers, regardless of size
Small Business Exemption	Small businesses are exempt from some requirements like data protection assessments

Consumer Rights Under NDPA

Right	Description
Right to Know	Confirm whether personal data is being processed and access that data
Right to Correct	Correct inaccuracies in personal data
Right to Delete	Delete personal data provided by or obtained about the consumer
Right to Portability	Obtain personal data in a portable, readily usable format
Right to Opt-Out	Opt out of targeted advertising, sale of personal data, and profiling

Sensitive Data Categories

The NDPA requires opt-in consent for processing sensitive data, including:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health conditions
• Sexual orientation or sex life
• Citizenship or immigration status
• Genetic or biometric data
• Personal data of known children
• Precise geolocation data

Accessibility Requirements

Nebraska government agencies must ensure digital accessibility for all residents:

State Government Obligations

• Nebraska state agencies must comply with ADA Title II for all public-facing digital content
• Office of the CIO/NITC provides accessibility guidance
• State websites must follow WCAG 2.1 Level AA guidelines
• Educational institutions must ensure accessible digital learning materials
• State IT procurement requires vendor accessibility compliance

Private Sector Considerations

• Businesses with physical locations in Nebraska are subject to ADA Title III
• Website accessibility claims can be brought under federal ADA
• Healthcare providers must ensure accessible patient portals
• Financial institutions must provide accessible online banking services

Enforcement

NDPA Penalties

Violation Type	Maximum Penalty
Per violation (after cure period)	$7,500 per violation
Consumer Protection Act violation	Additional penalties under Nebraska Consumer Protection Act
Injunctive relief	Court may order business practices to cease

Business Obligations

Obligation	Description
Privacy Notice	Clear notice of data categories, purposes, rights, and third-party sharing
Data Minimization	Limit collection to what is reasonably necessary for disclosed purposes
Purpose Limitation	Process data only for purposes disclosed to consumers
Security	Implement appropriate technical and organizational security measures
Sensitive Data Consent	Obtain opt-in consent before processing sensitive personal data
Request Response	Respond to consumer requests within 45 days (may extend 45 days)
Data Protection Assessments	Conduct assessments for high-risk processing (non-small businesses)

Consumer Rights

Nebraska residents have comprehensive privacy rights under the NDPA:

• Right to Access: Confirm processing and access personal data
• Right to Correct: Correct inaccurate personal data
• Right to Delete: Request deletion of personal data
• Right to Portability: Receive data in portable format
• Right to Opt-Out: Opt out of targeted advertising, sales, and profiling
• Right to Non-Discrimination: Cannot be penalized for exercising rights
• Right to Appeal: Appeal controller's decision on consumer requests

Related Resources

• US Privacy Laws Overview
• State Privacy Law Comparison
• ADA Title II Requirements
• All State Laws
• Privacy Compliance Guide
• Report a Violation