This Law Firm Publication by Alston & Bird LLP addresses a new law, effective July 20, 2016, that updates Nebraska's data breach notification statute. Nebraska will add to the definition of "personal information," a username or email in combination with a password or security question to permit access to an online account. In the event of a breach, the statute requires notice as soon as possible to the affected individual as well as Nebraska's Attorney General. Data is not considered encrypted if the breach includes acquisition of the encryption key or method.