NE LB241

Private entities in Nebraska are exempt from class action liability for cybersecurity events unless the event was caused by willful, wanton, or gross negligence

Cybersecurity events are defined as unauthorized access to, disruption of, or misuse of information systems or nonpublic information

Nonpublic information includes personally identifiable data combined with social security numbers, driver's license numbers, financial account numbers, security codes/passwords, or biometric records

Private entities covered include corporations, religious/charitable organizations, partnerships, LLCs, LLPs, and other business entities (for-profit or not-for-profit)

Approved by the Governor on March 17, 2025