Governance, risk & compliance
Nebraska Data Privacy Act (NDPA) LB 1074 (2024), ss. 1 to 30
The Nebraska Data Privacy Act (LB 1074 of 2024, ss.
1 to 30), operative 1 January 2025. Unlike most state laws it has no consumer-count threshold: it applies to any person that does business in Nebraska or produces products or services consumed by Nebraska residents, processes or sells personal data, and is not a small business under the federal Small Business Act.
A small business still may not sell sensitive data without the consumer’s prior consent (s. 18).
Nonprofits are exempt. Consumers can confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling for significant decisions, with a 45-day response (extendable once by 45 days) and a 60-day appeal.
Controllers must offer two or more request methods, allow authorized agents to opt out by technology, obtain consent for sensitive data, run data protection assessments and use processor contracts. The Attorney General alone enforces after a 30-day cure with a written statement; penalties reach $7,500 per violation and there is no private action.
Not verified: (1) The Revised Statutes of Nebraska codification was not read; sections are cited as LB 1074, s. N.
(2) No separate rule for teens aged 13 to 15 was found in the text read; only COPPA and known-child rules. (3) No mandated universal opt-out signal was found; s.
11 lets a consumer use an authorized agent or technology to opt out. General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Nebraska Data Privacy Act (NDPA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Controller | A person that, alone or jointly with others, determines the purpose and means of processing personal data and meets the applicability test in LB1074 s.3 (any non-small business (no consumer count)). Carries the notice, consumer rights, consent, security, assessment and enforcement duties. | — |
| Processor | A person that processes personal data on behalf of a controller (LB1074 s.15). Must follow the controller’s instructions, help with consumer requests and security, give assessment information, bind its people and subcontractors, and delete or return data at the end of the service. A processor that decides purposes and means is treated as a controller. | — |
| Small business | A business that meets the federal Small Business Act size standard. The Act otherwise does not apply to it, but s.18 still bars it from selling sensitive data without the consumer’s prior consent. | — |
How Lavawall® helps you get to Nebraska Data Privacy Act (NDPA) compliance
Most of Nebraska Data Privacy Act (NDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Nebraska Data Privacy Act (NDPA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Nebraska Data Privacy Act (NDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Nebraska Data Privacy Act (NDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Nebraska Data Privacy Act (NDPA) LB 1074 (2024), ss. 1 to 30
- Category
- Privacy
- Region
- USA - Nebraska
- Levels
- 3 assessment tiers
All Nebraska, United States frameworks and training →
Map this framework freeTalk to our team