Enforcement, legislation and court rulings, reported from primary sources
Iowa's chapter 715D, enacted as Senate File 262 and in force since January 1, 2025, is built from fewer parts than its neighbors. It has nine sections, four consumer rights, a 90-day response window, notice and opt-out in place of consent for sensitive data, no assessment requirement, and a 90-day cure with no end date.
Read more →Iowa's Personal Information Security Breach Protection chapter dates from 2008 and was reshaped in 2014 and 2018. It reaches paper printouts of computer records, lets a business skip notice only on a written no-harm finding kept five years, and puts a five-business-day Attorney General clock behind the first consumer notice.
Read more →Iowa Code 729.6, enacted in 1992 and rewritten in 2010, bars every Iowa employer regardless of size from soliciting, requiring or administering a genetic test as a condition of employment, requires written informed consent before anyone obtains genetic information, and lets an aggrieved worker, county attorney or the attorney general sue for equitable relief.
Read more →Kentucky's privacy statute, House Bill 15 of 2024, took effect January 1, 2026 at KRS 367.3611 to 367.3629. A 2025 act widened its health-data exemptions before it ever applied, its 30-day cure has no expiry, penalties flow to a dedicated fund, and the Attorney General invoked it eight days after it began.
Read more →Kentucky's private-sector breach statute was created by House Bill 232 in 2014 and has not been amended since. It counts an incident as a breach only if it causes or is reasonably believed to cause identity theft or fraud, requires no notice to any state office, and contains no enforcement clause of its own.
Read more →House Bill 5 of 2014 gave Kentucky's executive branch, local governments, school districts and public universities, and the contractors that receive their data, a security duty and a staged reporting chain: officials within 72 hours, again within 48 hours of the investigation's end, then affected individuals within 35 days.
Read more →Nebraska's design code, LB 504, was approved May 30, 2025 and became operative January 1, 2026. LB 838 rewrote its coverage test, more than doubled its list of engagement features and added two sections, effective July 18, 2026. Penalties of up to $50,000 became available July 1, 2026, and the Attorney General first pleaded the Act in October 2026.
Read more →Nebraska's Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006 requires a good-faith investigation before notice, routes every required notice to the Attorney General as well, offers a small-business newspaper option, and since 2018 carries a security duty enforced through the Consumer Protection Act.
Read more →Nebraska's Data Privacy Act, sections 1 to 30 of LB 1074 (2024), took effect January 1, 2025 at sections 87-1101 to 87-1130. It counts no consumers, reaching any business outside the federal small-business definition, and it still binds small businesses on selling sensitive data. Its cure demands proof, and no enforcement under it was found.
Read more →New Hampshire's three-section breach subdivision took effect January 1, 2007 and has not been amended. It requires notice when misuse is likely or cannot be determined, routes the state notice to a primary regulator or the Attorney General, and gives injured persons a damages action that doubles or trebles for willful violations.
Read more →New Hampshire's 2014 workplace privacy act, HB 1407 (chapter 305), bars employers from asking for login information to an employee's or applicant's personal social networking account, forcing contact additions, or demanding lower privacy settings. It keeps employer equipment, employer accounts and two kinds of investigation outside the bar, and is enforced only by a labor commissioner penalty.
Read more →RSA chapter 507-H, in force since January 1, 2025, reaches businesses at 35,000 consumers, requires opt-out signals, conditions teen targeting on consent, and from 2027 bars selling a child's data. Violations are prosecuted under the consumer protection act at up to $10,000 each, and the chapter grants no rulemaking power.
Read more →