Laws
Nebraska Data Privacy Act (NDPA): your rights and how to use them
Quick answer
If you live in Nebraska, the Nebraska Data Privacy Act lets you ask a business to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. According to the Nebraska Attorney General, the business has 45 days to answer and two responses a year are free. If it refuses, appeal to the business first, then file a Data Privacy Complaint with the Attorney General.
All privacy laws“Request deletion of personal data provided by or obtained about the consumer that is being used by the controller”
- Applies in
- Nebraska
- In force since
- Companies must answer within
- According to the Nebraska Attorney General: 45 days to respond, plus 45 more if the business tells you within the first 45 days that it needs them and why. A refusal must come within the first 45 days with instructions on how to appeal. Appeals get a response within 60 days. Two responses a year are free.
- Regulator
- Nebraska Attorney General
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: protectthegoodlife.nebraska.gov, nebraskalegislature.gov
Last verified against the official page:
Nebraska residents acting as individuals or households, not in a work or business role. According to the Nebraska Attorney General, the law applies to any business that operates in Nebraska or makes a product or service Nebraskans use, that processes or sells personal data, and that isn't a small business under the federal Small Business Act as it stood on January 1, 2024. There's no minimum number of customers. A small business can still be penalized for selling sensitive data without consent. Excluded organizations, information and uses are listed in Neb. Rev. Stat. §§ 87-1103 to 87-1106.
Your rights
-
Confirm and access
Ask a business whether it processes your personal data, and see that data.
-
Correct
Have inaccurate data fixed, where the data is relevant to why the business processes it.
-
Delete
Have a business delete personal data you gave it or that it obtained about you and is using.
-
Get a copy
Get a copy of the data you gave the business, if it's available in digital form and processed by completely automated means, and take it to another company.
-
Opt out
Stop the business using your data for targeted advertising, selling it, or profiling you.
-
Requests for a child
Send a request about the personal data of your known child.
-
Appeal
Appeal a refusal through the business's own appeal process. The business must respond within 60 days.
-
No retaliation
A business can't discriminate against you for using these rights, for example by refusing you goods or services, charging a different price or giving you a lower level of quality.
General information, not legal advice.
How to use it
- 1
Find the request methods in the privacy notice
According to the Nebraska Attorney General, businesses must offer two or more ways to send a request and can't make you create a new account to do it. The privacy notice must describe how to send one.
- 2
Say which rights you want to use
Name them plainly: access, correction, deletion, a copy, or an opt-out. A line like "Under the Nebraska Data Privacy Act, please delete the personal data you hold about me" is enough to start. You can also ask about your known child's data.
- 3
Confirm your identity if asked
The business may ask you to authenticate yourself before it processes the request.
- 4
Wait up to 45 days
The business has 45 days to respond, and another 45 if it tells you within the first 45 days that it needs them and why. If it declines, it must tell you within those first 45 days and explain how to appeal.
- 5
Appeal if the business refuses
Use the business's appeal process. It must respond within 60 days.
- 6
File a Data Privacy Complaint with the Attorney General
The Attorney General asks you to go to the business and appeal first. Once your appeal is denied or you get no response, use the File A Data Privacy Complaint link on the Attorney General's Rights of Consumers page to complete the Data Privacy Complaint Form.
No answer in time? Complain to Nebraska Attorney General .
Who has to follow the Nebraska Data Privacy Act
Delaware, Kentucky, Maryland and Minnesota only cover businesses above a minimum number of consumers. Nebraska's law has no such number. According to the Nebraska Attorney General, it covers any business that operates in Nebraska or makes a product or service Nebraskans use, processes or sells personal data, and isn't a small business under the federal Small Business Act. Small businesses are mostly outside it, but even a small business can be penalized for selling sensitive data without consent.
The Attorney General's office enforces the law and publishes the consumer guidance on its Protect The Good Life site.
Why a company can say no
The first limit is in the definition. According to the Attorney General, personal data doesn't include publicly available information or data that can't reasonably be linked to a person. A people-search site may point to that when it refuses.
A business also doesn't have to act on a request if it can't reasonably link the request to your data, or if doing so would be unreasonably burdensome. The same goes when it doesn't use the data to recognize you or link it to other data about you, or doesn't sell or share it beyond its processors.
The law's exclusions sit in the statute itself: Neb. Rev. Stat. §§ 87-1103 to 87-1106 list the organizations, types of information and uses it doesn't cover. If a company cites one of those sections, that's where to check.
You can still appeal, and file a complaint with the Attorney General if you think the refusal is wrong. Our guide on what to do when a company won't delete your account covers the next steps.
Where Serus fits
The Nebraska law works one company at a time, and you first have to know which companies hold your data. Serus finds the data brokers that operate where you live, sends the deletion and opt-out requests for you, and checks whether your data shows up again. The steps above are free if you'd rather do them yourself.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
When did the Nebraska privacy law take effect?
January 1, 2025, according to the Nebraska Attorney General.
Does the Nebraska law apply to small businesses?
Mostly not. It applies only to businesses that aren't small businesses under the federal Small Business Act. A small business can still be penalized if it sells sensitive data without your consent.
What do I have to do before complaining to the Attorney General?
Send your request to the business, appeal if it refuses, and once the appeal is denied or goes unanswered, complete the Attorney General's Data Privacy Complaint Form.
Can a business charge me for a request?
Two responses a year are free. A business may charge a reasonable fee if a request is manifestly unfounded, excessive or repetitive.
Does publicly available information count as personal data?
No. According to the Attorney General, personal data doesn't include publicly available information or data that can't reasonably be linked to a person.
Sources
Something wrong or out of date? Tell us and we'll re-check it.