1. Home
  2. State breach laws
  3. Nebraska

Nebraska data breach notification law

What Nebraska requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Neb. Rev. Stat. §§ 87-801 to 87-808 (Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006).

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
Limits class actions
Liability protection

What this means if you sell security services

Nebraska sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Nebraska breach filings →

Requirements in detail

Statute
Neb. Rev. Stat. §§ 87-801 to 87-808 (Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006)
Deadline to notify residents
As soon as possible and without unreasonable delay after a prompt, good-faith investigation finds that misuse of the information has occurred or is reasonably likely. Notice may be delayed if law enforcement determines it would impede a criminal investigation.
Attorney General notification
Yes, for any breach that requires notice to Nebraska residents. The Attorney General must be notified no later than the time notice is provided to residents.
Penalties
The Attorney General may issue subpoenas and recover direct economic damages for each affected Nebraska resident injured by a failure to notify. A violation of the law's reasonable-security requirement (section 87-808) is treated as a deceptive trade practice under the Consumer Protection Act, which carries civil penalties of up to $2,000 per violation.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Nebraska's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
Nebraska (2025) bars class-action liability for a cybersecurity event unless it resulted from willful, wanton, or grossly negligent conduct. No security program is required to qualify. These protections limit lawsuits; they don't change the duty to notify. Neb. Rev. Stat. § 87-1201 (LB 241, 2025)
Recent changes
Legislative Bill 241 (2025), approved March 17, 2025, and codified at section 87-1201, shields private entities from class-action liability for a cybersecurity event unless it was caused by willful, wanton, or grossly negligent conduct. Individual lawsuits are not barred. It took effect September 3, 2025, and did not change the notice requirements.

Nebraska breach notification FAQ

What is the data breach notification deadline in Nebraska?

As soon as possible and without unreasonable delay after a prompt, good-faith investigation finds that misuse of the information has occurred or is reasonably likely. Notice may be delayed if law enforcement determines it would impede a criminal investigation. The governing law is Neb. Rev. Stat. §§ 87-801 to 87-808 (Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006).

Does Nebraska require notifying the Attorney General of a data breach?

Yes, for any breach that requires notice to Nebraska residents. The Attorney General must be notified no later than the time notice is provided to residents.

What are the penalties for failing to report a data breach in Nebraska?

The Attorney General may issue subpoenas and recover direct economic damages for each affected Nebraska resident injured by a failure to notify. A violation of the law's reasonable-security requirement (section 87-808) is treated as a deceptive trade practice under the Consumer Protection Act, which carries civil penalties of up to $2,000 per violation.

Can individuals sue over a data breach in Nebraska?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Nebraska?

Nebraska's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Nebraska limit breach lawsuits for companies with a cybersecurity program?

Nebraska (2025) bars class-action liability for a cybersecurity event unless it resulted from willful, wanton, or grossly negligent conduct. No security program is required to qualify. These protections limit lawsuits; they don't change the duty to notify.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Nebraska Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →