ShareAndGoShareAndGo

Data breach notification

Nebraska data breach notification law

Nebraska's breach rules are the Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006, at Neb. Rev. Stat. §§ 87-801 to 87-808.

In Nebraska the order of events matters: investigate first, then decide, then tell residents and the Attorney General together.

Step one is an investigation

The act asks a business to look into an incident before anyone is told. If the investigation determines that the use of information about a Nebraska resident for an unauthorized purpose has occurred or is reasonably likely to occur, the business shall give notice to the affected Nebraska resident.

So the question the act puts is about misuse, not only about access. Where the investigation finds misuse neither happened nor is reasonably likely, the notice duty in § 87-803 does not attach.

What a breach means here

Breach of the security of the system means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information. Personal information starts with a Nebraska resident's first name or first initial and last name, combined with a data element, where the name or element has not been encrypted, redacted, or otherwise made unreadable.

Elements on the list

  • Social Security number.
  • Driver's license or state identification number.
  • Account or card number with any required code or password.
  • A unique electronic identification number or routing code with any required code.
  • Unique biometric data, such as a fingerprint, voice print, or retina or iris image.

Separately, a user name or email address in combination with a password or security question and answer that would permit access to an online account counts on its own.

Deadlines

Notice to residents shall be made as soon as possible and without unreasonable delay. No day count appears in the sections we read. The Attorney General must receive notice of the breach not later than the time when notice is provided to the Nebraska resident. There is no minimum number of residents for that Attorney General notice; it follows any breach that requires resident notice.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Watermarking is a per-room setting and is on by default, so each viewed page shows who opened it. Recipients need no account; they confirm their email with a six-digit code. Folder access follows groups, so an investigation can start from the short list of people who could open a file. The log itself is chained and can be exported as CSV for whoever runs the review.

Nebraska questions

Does Nebraska require an investigation?
Yes. The decision to give notice follows a finding that unauthorized use has occurred or is reasonably likely to occur.
Is encrypted data covered?
A breach is defined as acquisition of unencrypted computerized data, so encrypted data falls outside it.
Do online login details count?
Yes. A user name or email address with a password or security question and answer that opens an online account is personal information.
Is there a day limit?
The text says as soon as possible and without unreasonable delay, with no fixed number of days.

Checked against

Checked against Nebraska's published law on November 2, 2026. This is general information, not legal advice.

More reading

Breach notification laws by state

All 54 jurisdictions on one page.

Compare data rooms

See how data rooms compare.

ShareAndGo home

ShareAndGo home.