Data Breach Notice to Residents and State Authorities in Nebraska
At a glance
| Covered entity and service provider | NE business owning/licensing resident PI; nonowner holder alerts and cooperates with owner/licensee when aware of breach with actual or likely unauthorized use (§ 87-803(1),(3)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of unencrypted computerized PI; compromised key means data not encrypted; name plus SSN, ID, financial access, routing code, or biometrics, or online credentials (§ 87-802(1),(3),(5)) |
| Risk screen or notice exception | Prompt good-faith investigation; resident and owner notice when unauthorized use occurred or is reasonably likely; good-faith employee and court-order acquisitions excluded (§§ 87-803(1),(3), 87-802(1)) |
| Individuals who receive notice | Affected Nebraska resident after investigation finds actual or reasonably likely unauthorized use (§ 87-803(1)) |
| Individual notice deadline and clock | As soon as possible and without unreasonable delay; no fixed outer day limit (§ 87-803(1)) |
| Regulator threshold and deadline | Attorney General notice for every breach requiring resident notice, no later than resident notice; no numerical threshold (§ 87-803(2)) |
| Consumer-reporting-agency notice | No separate consumer-reporting-agency notification in §§ 87-802 to -804 (§§ 87-803(1)-(4), 87-804(1),(2)) |
| Individual delivery and content | Writing, telephone, or qualifying electronic notice; no itemized resident-letter contents in §§ 87-802 to -804 (§ 87-802(4)) |
| Substitute notice conditions and channels | Cost over $75,000, over 100,000 residents, or insufficient contacts: email if held AND website if maintained AND statewide media; <=10 employees and cost over $10,000 has additional local-ad route (§ 87-802(4)(d),(e)) |
| Delays and alternate compliance | Law-enforcement finding that notice impedes criminal investigation permits delay until cleared; timely own-policy or primary-regulator procedures must notify residents AND AG (§§ 87-803(4), 87-804(1),(2)) |
Requirements one by one
Data, breach, and investigation
Neb. Rev. Stat. § 87-802(1),(3),(5) covers unauthorized acquisition of unencrypted computerized personal information. If the confidential decryption process or key was or likely was acquired in the breach, the data is not treated as encrypted. Covered information includes a resident's name with Social Security, driver or state ID, financial-account access, routing/access codes, or biometrics; online-account credentials also qualify. Lawfully public government-record information is excluded. Good-faith employee acquisition without unauthorized use or further disclosure, and acquisition under a warrant, subpoena, or qualifying order, are excluded from the breach definition.
Section 87-803(1) requires a prompt, reasonable, good-faith investigation. If it finds that unauthorized use occurred or is reasonably likely, the owner or licensee must notify affected residents.
Residents, data owner, and Attorney General
Resident notice under § 87-803(1) must be as soon as possible and without unreasonable delay; the section sets no fixed outer day count. Section 87-803(2) requires Attorney General notice for every breach requiring resident notice, no later than when residents are notified. The section specifies no numerical threshold or itemized Attorney General submission.
A holder of someone else's computerized data must notify and cooperate with the owner or licensee when it becomes aware of a breach and unauthorized use occurred or is reasonably likely under § 87-803(3). Cooperation includes sharing relevant breach information other than the holder's proprietary information.
Delivery and substitute routes
Section 87-802(4) permits written, telephone, or qualifying electronic notice. Substitute notice is available when direct notice would cost over $75,000, the affected Nebraska class exceeds 100,000, or contacts are insufficient. It requires email where addresses exist, a conspicuous website post if there is a site, and major statewide media.
A separate route applies to an entity with 10 or fewer employees if direct notice would cost over $10,000. It requires email where possible, a paid local newspaper advertisement covering at least one-quarter page once a week for three consecutive weeks, website posting if maintained, and major local media. Sections 87-802 to 87-804 do not list mandatory words or details for the resident message or require a consumer-reporting-agency notice.
What trips people up
Attorney General notice follows the resident duty without a size threshold. Section 87-803(2) ties it to every required resident notice and requires it no later than that notice.
Regulated-policy routes still include the Attorney General. Under § 87-804(1),(2), own-policy or primary-regulator procedures count as compliance only with the stated conditions and notice to both affected residents and the Attorney General.
Police delay requires an agency determination. Section 87-803(4) permits delay if notice would impede a criminal investigation; notice follows as soon as possible without unreasonable delay after the agency says it no longer would.
Common questions
Must a small breach be reported to the Attorney General?
If the § 87-803(1) resident notice duty arises, yes: § 87-803(2) states no minimum resident count.
Does Nebraska set a 30-day outside limit for residents?
No. Section 87-803(1) instead requires notice as soon as possible without unreasonable delay.
Statutes and sources
- Neb. Rev. Stat. § 87-802 — breach and personal-information definitions; delivery and substitute notice.
- Neb. Rev. Stat. § 87-803 — investigation, resident, owner, and Attorney General notice.
- Neb. Rev. Stat. § 87-804 — policy and regulatory-procedure compliance.
Current Nebraska Legislature text checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Nebraska law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Nebraska law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace