Nebraska Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Nebraska's Financial Data Protection and Consumer Notification of Data Security Breach Act, under Neb. Rev. Stat. 87-803, requires businesses to notify affected residents as soon as possible and without unreasonable delay after a breach. The Nebraska Attorney General must receive notice no later than the time notice is provided to individuals.

If your business handles personal information belonging to Nebraska residents, a data breach triggers specific legal obligations under the Nebraska Financial Data Protection and Consumer Notification of Data Security Breach Act. Neb. Rev. Stat. 87-801 et seq. sets out the requirements for determining when a breach has occurred, who must be notified, what information triggers notification, and the consequences of noncompliance. Nebraska's law has evolved significantly since its original enactment, with recent amendments expanding the definition of personal information to include biometric data and login credentials.

This guide covers the full scope of Nebraska's breach notification requirements, including what personal information triggers the law, who must be notified, the notification timeline, the class-action liability shield for cybersecurity events, penalties, and how the state's broader data privacy framework interacts with breach obligations.

Who Must Comply With Nebraska's Breach Notification Law

Nebraska's law applies to any individual or commercial entity that conducts business in Nebraska and owns, licenses, or maintains computerized data that includes personal information about a Nebraska resident. This includes businesses physically located outside Nebraska if they hold data belonging to Nebraska residents.

The law distinguishes between data owners and third-party data maintainers. When a third party that maintains data on behalf of another entity becomes aware of a breach, it must give notice to and cooperate with the data owner or licensee, including by sharing information relevant to the breach. Neb. Rev. Stat. 87-803(3) ties that duty to the point when the maintainer becomes aware of the breach and sets no separate deadline of its own. The data owner then carries the primary responsibility to notify affected consumers and the Attorney General.

Government Entities

Nebraska's breach notification law applies to state and local government entities that maintain personal information about Nebraska residents. Government agencies have the same notification obligations as private businesses.

What Qualifies as a Breach

Under Neb. Rev. Stat. 87-802, a "breach of the security of the system" means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the individual or commercial entity.

Good Faith Exception

A good faith acquisition of personal information by an employee or agent of the individual or commercial entity does not constitute a breach, provided the personal information is not used for an unauthorized purpose or subject to further unauthorized disclosure.

Nebraska law also excludes from the definition of breach any acquisition of personal information made pursuant to a search warrant, subpoena, or other court order, or pursuant to a subpoena or order of a state agency.

Encryption Safe Harbor

Nebraska provides a clear safe harbor for encrypted data. A breach does not trigger notification requirements if the personal information was encrypted, and the encryption key or other means to decipher the information was not also acquired. If the encryption key was compromised along with the data, the safe harbor does not apply.

Risk of Harm Analysis

Nebraska law includes a risk assessment component. After discovering a possible breach, the entity must conduct a reasonable and prompt investigation to determine the likelihood that personal information has been or will be used for an unauthorized purpose. Notification is required only if the investigation determines that the use of the information for an unauthorized purpose has occurred or is reasonably likely to occur.

Personal Information That Triggers Notification

Nebraska's definition of personal information is one of the broadest among U.S. states. Under Neb. Rev. Stat. 87-802, personal information means a Nebraska resident's first name or first initial and last name combined with any one or more of the following data elements:

• Social Security number
• Driver's license number or state identification card number
• Account number or credit or debit card number combined with any required security code, access code, or password that would permit access to the account
• Unique electronic identification number or routing code combined with any required security code, access code, or password
• Biometric data (fingerprint, voice print, retina or iris image, or other unique physical representation)
• Username or email address combined with a password or security question and answer that would permit access to an online account

The inclusion of biometric data and username/password combinations places Nebraska among the states with the most comprehensive definitions of protected personal information.

Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

Notification Timeline

Nebraska requires notification "as soon as possible and without unreasonable delay" under Neb. Rev. Stat. 87-803. The state does not impose a specific day count, giving entities flexibility to investigate before notifying.

When Delay Is Permitted

Delay in notification is reasonable if it is necessary to:

1. Determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system
2. Comply with a request from law enforcement that notification may impede a criminal investigation

When a delay occurs for law enforcement purposes, notification must be made as soon as possible after law enforcement determines disclosure no longer compromises the investigation.

Who Must Be Notified

Affected Individuals

Every Nebraska resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person must be notified. Nebraska's statute does not prescribe the content of the notice to residents, but a well-drafted notice conventionally includes:

• A description of the incident in general terms
• The type of personal information that was subject to the breach
• The telephone number, address, and website of the entity providing notice
• The toll-free telephone numbers, addresses, and websites of the major consumer reporting agencies
• The toll-free telephone number, address, and website of the Federal Trade Commission
• A statement advising the individual to remain vigilant by reviewing account statements and monitoring credit reports

Nebraska Attorney General

The Nebraska Attorney General must be notified no later than the time affected individuals are notified, under Neb. Rev. Stat. 87-803(2). The statute fixes that deadline but does not prescribe what the notice to the Attorney General must contain, and no Nebraska rule supplies a required form or format. In practice, entities commonly provide:

• A description of the nature of the breach
• The number of Nebraska residents affected
• The steps the entity has taken in response
• A copy of the notification sent to affected individuals

Consumer Reporting Agencies

Nebraska's breach notification law does not require notice to consumer reporting agencies. The Financial Data Protection and Consumer Notification of Data Security Breach Act imposes only two notification duties: notice to affected Nebraska residents and notice to the Attorney General.

How to Provide Notification

Nebraska permits the following notification methods:

• Written notice sent by mail to the last known address of the individual
• Electronic notice if the entity's primary means of communication with the individual is by electronic means, consistent with the E-SIGN Act (15 U.S.C. 7001)
• Telephone notification

Substitute Notice

Substitute notice is available when:

• The cost of notification would exceed $75,000
• The affected class exceeds 100,000 Nebraska residents
• The entity does not have sufficient contact information

Substitute notice must consist of all of the following:

1. Email notice to individuals for whom the entity has an email address
2. Conspicuous posting of the notice on the entity's website
3. Notification to major statewide media outlets

Small-Business Substitute Notice

Nebraska also provides a separate, easier-to-reach substitute notice path for small entities. An individual or commercial entity with ten employees or fewer that demonstrates the cost of notification will exceed $10,000 may use substitute notice consisting of all of the following:

1. Email notice to individuals for whom the entity has an email address
2. A paid newspaper advertisement covering at least one-quarter of a page, published at least once a week for three consecutive weeks
3. Conspicuous posting of the notice on the entity's website
4. Notification to major media outlets in the entity's local geographic area

Because the small-business path triggers at a $10,000 cost threshold rather than $75,000, small Nebraska businesses can qualify for substitute notice far more easily than the general thresholds alone suggest.

Class-Action Liability Shield for Cybersecurity Events

Nebraska does not have a NIST- or ISO-framework-based affirmative defense against tort claims. What it does have is narrower: under Neb. Rev. Stat. 87-1201, enacted by LB241 (2025), a private entity is not liable in a class action resulting from a cybersecurity event unless the event was caused by willful, wanton, or gross negligence on the entity's part.

A "cybersecurity event" is defined as unauthorized access to, or disruption or misuse of, an information system or nonpublic information. The shield applies only to class actions; it does not bar individual lawsuits, and it does not limit the Attorney General's regulatory enforcement authority under the breach notification law or the Consumer Protection Act.

Enforcement and Penalties

Nebraska's breach notification law is enforced by the Nebraska Attorney General. For a violation of the notification-timing statute (Neb. Rev. Stat. 87-803), the Attorney General may issue subpoenas and recover direct economic damages for each affected Nebraska resident injured, under Neb. Rev. Stat. 87-806. The statute sets no dollar cap on this remedy.

A separate requirement, the reasonable-security-procedures duty under Neb. Rev. Stat. 87-808, is treated as a violation of the Consumer Protection Act and carries a civil penalty of up to $2,000 per violation under Neb. Rev. Stat. 59-1614. That penalty applies to a failure to maintain reasonable security procedures, not to a delay in notifying residents.

There is no private right of action for breach notification violations. Only the Attorney General can bring enforcement actions.

Exemptions and Deemed Compliance

Nebraska does not exempt federally regulated entities from its breach notification requirements. Instead, Neb. Rev. Stat. 87-804 lets an entity satisfy the statute by following its own procedures, and only on the condition that the required notices still go out:

• Entities with their own notice procedures. Under 87-804(1), an entity whose information security policy includes notice procedures otherwise consistent with the timing requirements of 87-803 is deemed in compliance if it notifies affected Nebraska residents and the Attorney General in accordance with those procedures.
• Entities regulated by state or federal law. Under 87-804(2), an entity that maintains breach procedures under the laws, rules, regulations, guidances, or guidelines of its primary or functional state or federal regulator, such as a GLBA-regulated financial institution or a HIPAA-covered entity, is deemed in compliance with 87-803 if it notifies affected Nebraska residents and the Attorney General in accordance with those maintained procedures.

The practical consequence is that notice to the Nebraska Attorney General is still owed. A regulated entity that notifies its federal regulator and its customers but skips the Nebraska Attorney General does not qualify for deemed compliance under 87-804.

A separate provision, Neb. Rev. Stat. 87-808(3), addresses the reasonable-security duty rather than notice. An entity satisfies that duty by complying with a state or federal law that provides greater protection to personal information than 87-808 provides, or with the regulations promulgated under Title V of the Gramm-Leach-Bliley Act or HIPAA if it is subject to those acts.

This article provides general legal information about Nebraska data privacy laws and breach notification requirements. It is not legal advice, and it does not create an attorney-client relationship. Data breach response involves time-sensitive obligations. Consult a qualified attorney licensed in Nebraska for guidance specific to your situation.

More Nebraska Laws

• Nebraska Deepfake Laws
• Nebraska Employee Monitoring Laws
• Nebraska GPS Tracking Laws
• Nebraska Recording Laws