Blog

Nebraska becomes latest state to join US privacy landscape

Governor Jim Pillin signed the Nebraska Data Privacy Act into law on April 17, 2024 making it the fourth state to pass such legislation in 2024

Alexis Kateifides
Director, Regulatory Intelligence
April 19, 2024

Who does the Nebraska Data Privacy Act apply to?
What are the key requirements of the NDPA?
Next steps and how to prepare for the NDPA

On April 17, 2024, the Nebraska Data Privacy Act (NDPA) was signed into law by Governor Jim Pillin, making it the latest state to join the US privacy landscape this year - and the 17th overall. The NDPA bears similarities with many of the laws passed in 2024 including provisions for risk assessments and a range of consumer rights. As with many state privacy laws, the NDPA will be enforced by the Attorney General and is set to enter into effect on January 1, 2025. Here is a closer look at some of the key requirements of the law.

Who does the Nebraska Data Privacy Act apply to?

Unlike most US state privacy laws, the NDPA does not outline a quantifiable application threshold. However, it does define three criteria that an organization must meet for the act to apply. The NDPA will apply to organizations that:

Conduct business in the state of Nebraska or produce a product or service consumed by residents of Nebraska
Process or engage in the sale of personal data
Are not a small business as determined under the federal Small Business Act

There are a range of organizational exemptions to the NDPA including where organizations are a state agency or a financial institution subject to the Gramm-Leach-Bliley Act (GLBA), among others. There are also data level exemptions such as protected health information under the Health Insurance Portability and Accountability Act (HIPAA) and the NDPA does not apply to the processing of personal data by a person in the course of a purely personal or household activity.

What are the key requirements of the NDPA?

The NDPA follows closely in the footsteps of other state laws passed in 2024 such as in New Jersey, New Hampshire, and Kentucky. The NDPA sets out rules for privacy notices, consent, and risk assessments while also outlining a set of consumer rights to give individuals greater control over their personal information.

Consumer rights

A key element of the NDPA is the set of consumer rights it grants individuals. Consumer rights under the NDPA include:

The right to confirm processing
The right to access
The right to correct inaccuracies
The right to deletion
The right to data portability
The right to opt out of processing for the purposes of:
- Targeted advertising
- The sale of personal data
- Profiling

Under the NDPA, controllers must respond to consumer requests without undue delay and within 45 days but can request a 45-day extension. Controllers must also establish at least two secure methods for consumers to submit requests.

Consent

The NDPA defines consent as “a clear and affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer, including a statement written by electronic means or any other unambiguous affirmative action by the consumer.”

Consent cannot be obtained through the acceptance of broad terms, actions such as hovering over, muting, pausing, or closing a given piece of content, or through the use of dark patterns.

In the context of processing sensitive data - which under the NDPA includes, racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, and biometric data - organizations are required to operate on an opt-in basis, meaning that they cannot process a consumer’s sensitive data without first obtaining explicit consent to do so.

Privacy notices

To meet transparency requirements, organizations must provide individuals with a “reasonably accessible and clear privacy notice.” This privacy notice should contain the following information at a minimum:

The categories of personal data being processed
The purposes of processing
How a consumer can exercise their rights

How a consumer may appeal a controller's decision relating to a rights request
The categories of personal data shared with third parties
The categories of third parties that personal data; is shared with
A description of the methods individuals can use to make a consumer request

Data protection assessments

The NDPA sets out requirements for conducting data protection assessments for a range of specified processing activities. Controllers should undertake a data protection assessment when processing involves:

Processing personal data for targeted advertising
The sale of personal data
Processing personal data for profiling
The processing of sensitive data
Any processing activity that presents a heightened risk of harm to the consumer

Data protection assessments should identify and balance the benefits of the processing activities against the potential risks to the rights of the consumer. The NDPA also specifies that a single assessment may address a comparable set of processing activities and assessments conducted for compliance with other laws may satisfy the requirements of the NDPA.

Enforcement

As with most US state privacy laws, the local Attorney General will have exclusive authority to enforce NDPA and will post to its website further Information relating to:

The responsibilities of a controller
The responsibilities of a processor
A consumer's rights under the NDPA

The Attorney General will have the responsibility to investigate potential violations of the act and can issue a 30-day cure period for organizations to remediate any violations found. Failure to remedy violations after such a cure period will result in the organization being liable for civil penalties of up to $7,500 per violation. There is no privacy right of action.

Next steps and how to prepare for the NDPA

The Nebraska Data Privacy Act will take effect on January 1, 2025, providing organizations with less than one year to align their privacy programs with this new set of rules. While many of the requirements set out by the NDPA resemble those found under other state privacy laws, organizations should first ensure that highly visible areas of compliance such as privacy notices and consumer rights requests processes meet the specific criteria this law sets out.

Learn more about how the OneTrust Privacy & Data Governance cloud can help you to get your privacy program up to speed with the Nebraska Data Privacy Act.

Blog

Nebraska becomes latest state to join US privacy landscape

Table of contents

Who does the Nebraska Data Privacy Act apply to?

What are the key requirements of the NDPA?

Consumer rights

Consent

Privacy notices

Data protection assessments

Enforcement

Next steps and how to prepare for the NDPA

You may also like

Privacy Management

2024 to 2025: Preparing for the next wave of privacy regulations

Prepare for 2025's privacy changes with this recap webinar on 2024's regulations and explore upcoming laws, trends, and compliance strategies.

January 23, 2025

Privacy Management

Staying equipped for compliance: A global recap of emerging privacy laws

November 20, 2024

Consent & Preferences

Mastering US opt-out requirements: A practical guide for marketers

Discover how to manage US opt-out requirements and enhance your marketing efforts with this guide. Download now to simplify compliance and build trust.

October 22, 2024

Privacy Automation

Global regulatory update: Recent privacy developments and compliance trends

Join us for a webinar on the latest updates and emerging trends in global privacy regulations.

September 12, 2024

Privacy Management

Preparing for child data protection laws in the US

Join DataGuidance and a panel of experts as we discuss US privacy laws the protection of minors' data.

August 07, 2024

Privacy Management

The road to 50 states: Rhode Island joins the US privacy landscape with a new law

Rhode Island has become the 20th US State to pass a privacy law. On June 25, 2024, the Governor of Rhode Island transmitted the Data Transparency and Privacy Protection Act (RIDTPPA) without signature allowing the Act to become law. Join the webinar to learn more.

July 16, 2024

Privacy Management

Preparing for the future of privacy in healthcare: Going beyond HIPAA compliance

Join us for a discussion on preparing your organization for healthcare privacy compliance that goes beyond HIPAA.

July 11, 2024

Privacy Management

The road to 50 states: Minnesota and Vermont join the US privacy landscape

In this webinar, OneTrust DataGuidance and expert contributors unpack the MCPA and VDPA, examining the requirements, exceptions, and practical implications of the legislations on the data controllers and processors.

June 17, 2024

Privacy Management

From legislation to operation: How to prepare for the new wave of US Privacy laws

Prepare your organization for the new wave of US privacy laws.

June 06, 2024

Third-Party Risk

TPRM privacy compliance: Questions to ask when working with third parties

Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.

May 31, 2024

Comparing US state privacy law requirements

Download our infographic and compare the many US state privacy law requirements that have been enacted or will soon come into effect.

May 14, 2024

Privacy Management

Federal US privacy bill on the horizon? Exploring the draft APRA & new state privacy legislation

Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.

April 23, 2024

Privacy Management

US state privacy laws timeline

View our timeline to understand the progression of current US state privacy laws and key dates.

April 23, 2024

Privacy Management

Spring into action! Navigating CPRA: Ensuring compliance and protecting privacy

Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.

March 21, 2024

Privacy Management

The road to 50 states: New Jersey and New Hampshire join the US privacy landscape

oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.

February 01, 2024

Privacy Automation

Embedding Privacy by Design through PIA Automation

Join us for a webinar on Embedding Privacy by Design through PIA Automation.

January 11, 2024

Privacy Management

Automating fulfillment of subject rights requests in the US

Learn how Privacy Rights Automation helps to fully automate privacy rights requests.

December 06, 2023

Privacy Management

December's deadline: Ensuring compliance with Utah's privacy regulation