87-1103.

Applicability of act to persons or entities.

(1) The Data Privacy Act applies only to a person that:

(a) Conducts business in this state or produces a product or service consumed by residents of this state;

(b) Processes or engages in the sale of personal data; and

(c) Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section 87-1118 applies to a person described by this subdivision.

(2) The Data Privacy Act does not apply to any:

(a) State agency or political subdivision of this state;

(b) Financial institution, affiliate of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., as such title existed on January 1, 2024;

(c) Covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 C.F.R. parts 160 and 164, as such parts existed on January 1, 2024, and Division A, Title XIII, and Division B, Title IV, of the federal Health Information Technology for Economic and Clinical Health Act, Public Law No. 111-5, as such act existed on January 1, 2024;

(d) Nonprofit organization;

(e) Institution of higher education;

(f) Electric supplier or supplier of electricity as defined in section 70-1001.01;

(g) Natural gas public utility as defined in section 66-1802; or

(h) Natural gas utility owned or operated by a city or a metropolitan utilities district.