← All jurisdictions
NE · data breach notification

Nebraska

med

Neb. Rev. Stat. §87-801 et seq.

Individual deadline
No fixed limit
Trigger standard
Risk of harm
AG / regulator
Required
Notice to individualsin the most expedient time possible and without unreasonable delay
Risk-of-harm standardno notice if investigation determines use for an unlawful purpose has not occurred and is not reasonably likely
Encryption safe harborYes, encrypted data (key not compromised) generally exempt.
Regulator noticeNebraska Attorney General, required for any affected resident; not later than individual notice
Written notice to AG
Credit reporting agenciesNo CRA-notice requirement.
Substitute noticeTypically available above $250,000 cost / 500,000 affected (verify).
Private right of actionNo, enforcement by the state.

Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Nebraska breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →