Does Nebraska's Data Privacy Act apply to your business?

Nebraska took the same route as Texas rather than the one most states use. Instead of setting a consumer count or a revenue figure, it borrows a federal definition of small business and uses that as the on-off switch. The Nebraska Data Privacy Act took effect on January 1, 2025, and the practical effect of its design is that many businesses cannot answer "does it apply to me?" from their own dashboards. They have to check a size standard tied to their industry.

Who the Nebraska Data Privacy Act covers

Under Neb. Rev. Stat. 87-1103, the act applies to a person that conducts business in Nebraska or produces a product or service consumed by Nebraska residents, that processes or engages in the sale of personal data, and that is not a small business as determined under the federal Small Business Act as it existed on January 1, 2024. All three parts must be true. There is no consumer-count or revenue threshold anywhere in the test. If you are above the small-business size standard for your sector and you handle personal data connected to Nebraska, you are likely covered.

The small-business gate, and its one exception

Because the gate is the federal Small Business Act, the answer depends on the industry code that applies to you and the size standard attached to it, whether that is measured by employee count or annual receipts. That is why two companies with identical revenue can land on opposite sides of the line. There is an important carve-out that runs the other way: even a small business that is otherwise outside the act may not sell a consumer's sensitive data without consent under Section 87-1118. So being a small business does not give you a free pass on sensitive-data sales. Texas uses the same structure, which is why the Texas Data Privacy and Security Act is the closest comparison.

Who is carved out

Section 87-1103(2) exempts whole categories of organization: state agencies and political subdivisions, financial institutions and data subject to the Gramm-Leach-Bliley Act, HIPAA-covered entities and business associates, nonprofit organizations, institutions of higher education, and certain electric and natural gas utilities. These are entity-level exemptions, so a covered nonprofit sits outside the act even when it processes data for large numbers of people. If you want to see how a no-threshold law compares with a volume-based one, the Virginia VCDPA sets the standard 100,000-consumer model, the privacy thresholds by state page lines every state's numbers up side by side, and the US state privacy laws hub maps them together.

Next step

Because Nebraska's gate is a size standard rather than a number you already track, the honest answer to "does it apply?" often needs the right industry code and its threshold. The free 2-minute Obligation Scan checks the 87-1103 test against your business and flags the notice, opt-out, and sensitive-data consent duties that follow, so you can act on the statute rather than a guess.