Revises provisions relating to the processing of certain data. (BDR 52-505)

(Reprinted with amendments adopted on June 2, 2025)
SECOND REPRINT S.B. 63

- *SB63_R2*

SENATE BILL NO. 63–COMMITTEE ON COMMERCE AND LABOR

(ON BEHALF OF THE ATTORNEY GENERAL)

PREFILED NOVEMBER 20, 2024
____________

Referred to Committee on Commerce and Labor

SUMMARY—Revises provisions relating to the processing of
certain data. (BDR 52-505)

FISCAL NOTE: Effect on Local Government: Increases or Newly
Provides for Term of Imprisonment in County or City
Jail or Detention Facility.
Effect on the State: Yes.

~

EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted.

AN ACT relating to the Internet; establishing certain requirements
relating to de -identified data; prohibiting controllers of
online services, products or features from processing the
personal data of children for certain purposes ;
establishing requirements for the collection and
processing by controllers of certain types of data
belonging to children; requiring controllers to c onduct
certain assessments ; authorizing certain civil
enforcement; providing penalties; and providing other
matters properly relating thereto.
Legislative Counsel’s Digest:
The federal Children’s Online Privacy Protection Act establishes certain 1
requirements rel ating to the collection, use and disclosure of the personal 2
information of children on the Internet. (15 U.S.C. § § 6501 et seq.) Existing federal 3
regulations adopted pursuant to that Act require certain operators of Internet 4
websites to : (1) establish and maintain reasonable procedures to protect the 5
confidentiality, security and integrity of personal information collected from 6
children; and (2) obtain verifiable parental consent before the operator collects, 7
uses or discloses any personal information of a child. (16 C.F.R. § § 312.5, 312.8) 8
Sections 24 -35 of this bill enact certain additional requirements relating to the 9
collection and processing of personal data collected from children on the Internet 10
by controllers. Section 2 7 defines “controller” to mean any person who: (1) 11
operates or provides any online service, product or feature targeted to persons in 12
this State; and (2) determines the purpose and means of processing personal data . 13

– 2 –

- *SB63_R2*
Sections 25-26 and 28-31.9 define certain other terms , and section 24 establishes 14
the applicability of those definitions to sections 24-35. Section 32 exempts certain 15
entities, types of data and activities from the requirements of sections 24-35. 16
Section 32.5 requires a controller that is in possession of de -identified data to 17
take certain actions with respect to such data, including committing to not re -18
identify such data and contractually obligating any person to which the controller 19
provides such data to comply with the requirements of section 32.5. 20
Section 3 3 requires a controller to, before processing personal data from a 21
known child or collecting the precise geolocation data of such a child, obtain 22
verifiable consent from the parent or legal guardian of the child in accordance with 23
the federal Children’s Online Privacy Protection Act. Section 33 prohibits a 24
controller from processing the personal data of a known child for the purposes of : 25
(1) providing targeted advertising to the child ; (2) the sale of the personal data of 26
the child ; or (3) profiling the child for certain purposes. Section 33 additionally 27
prohibits a controller from processing the personal data or collecting the precise 28
geolocation data of a known child unless such processing or collection, as 29
applicable, is reasonably nec essary and limited in duration to enable the controller 30
to provide the online service , product or feature . Section 33 further requires a 31
controller that collects the precise geolocation data of a known child to, during all 32
times that the controller is coll ecting such data, provide an indication to the child 33
that such collection is occurring. Finally, section 33 requires a controller, if the 34
controller seeks to collect the personal data of a known child with the intent to 35
further process such data, to disclose to the child the purposes of such additional 36
processing. Section 33 prohibits a controller from further processing such data for a 37
purpose other than the purpose disclosed to the child, unless that purpose is 38
necessary for carrying out and compatible with the purpose disclosed to the child. 39
Section 3 4 requires a controller that offers any online service, product or 40
feature that is directed at children to conduct and retain a data protection 41
assessment for each processing activity in which the controller engages. Section 34 42
also requires, in certain circumstances, a controller to provide a data protection 43
assessment prepared by the controller to the Attorney General. Sections 34 and 36 44
of this bill provide for the confidentiality of the information contained within a data 45
protection assessment that is provided to the Attorney General. Section 34 also 46
provides that, by disclosing to the Attorney General or the Office of the Attorney 47
General a data protection assessment as required by section 34, a controller does 48
not waive certain evidentiary privileges that would otherwise be applicable to the 49
information contained within the data protection assessment. 50
Existing law provides that a variety of actions constitute deceptive trade 51
practices. (NR S 100.180, 111.2397, 118A.275, 202.24935, 205.377, 226.600, 52
228.620, 370.695, 597.7642, 597.818, 597.997, 603.170, 603A.260, 603A.550, 53
604B.910, 676A.770; chapter 598 of NRS) Existing law authorizes a court or the 54
Director of the Department of Business and Industry to impose a civil penalty of 55
not more than $25,000 for each violation upon a person who has engaged in a 56
deceptive trade practice directed toward a minor. (NRS 598.09735) In addition, 57
existing law provides that when the Commissioner of Consumer A ffairs or the 58
Director has cause to believe that a person has engaged or is engaging in any 59
deceptive trade practice, the Commissioner or Director may request that the 60
Attorney General represent him or her in instituting an appropriate legal 61
proceeding, in cluding an application for an injunction or temporary restraining 62
order. (NRS 598.0979) Existing law requires a person who violates a court order or 63
injunction resulting from a complaint brought by the Commissioner, the Director, 64
the district attorney of a ny county of this State or the Attorney General to pay a 65
civil penalty of not more than $10,000 for each violation. Furthermore, if a court 66
finds that a person has willfully engaged in a deceptive trade practice, the person 67
who committed the violation: (1) may be required to pay an additional civil penalty 68

– 3 –

- *SB63_R2*
not more than $15,000 for each violation; and (2) is guilty of a felony or 69
misdemeanor, depending on the value of the property or services lost as a result of 70
the deceptive trade practice. (NRS 598.0999) Section 35 requires the Attorney 71
General, upon determining that a controller has violated or is violating any 72
provision of sections 24-35, to provide the controller written notice of the alleged 73
violation. Section 35 makes it a deceptive trade practice for a controller to fail to 74
remedy a violation of sections 24-35 within 30 days after receiving written notice 75
of the violation from the Attorney General. Section 35 grants the Attorney General 76
the exclusive authority to enforce the requirements of sections 24-35 and further 77
provides that those sections do not create a private right of action. 78

THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN
SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:

Section 1. (Deleted by amendment.) 1
Sec. 2. (Deleted by amendment.) 2
Sec. 3. (Deleted by amendment.) 3
Sec. 4. (Deleted by amendment.) 4
Sec. 4.1. (Deleted by amendment.) 5
Sec. 4.3. (Deleted by amendment.) 6
Sec. 4.5. (Deleted by amendment.) 7
Sec. 4.7. (Deleted by amendment.) 8
Sec. 5. (Deleted by amendment.) 9
Sec. 6. (Deleted by amendment.) 10
Sec. 7. (Deleted by amendment.) 11
Sec. 8. (Deleted by amendment.) 12
Sec. 9. (Deleted by amendment.) 13
Sec. 9.5. (Deleted by amendment.) 14
Sec. 10. (Deleted by amendment.) 15
Sec. 10.5. (Deleted by amendment.) 16
Sec. 11. (Deleted by amendment.) 17
Sec. 12. (Deleted by amendment.) 18
Sec. 13. (Deleted by amendment.) 19
Sec. 14. (Deleted by amendment.) 20
Sec. 15. (Deleted by amendment.) 21
Sec. 16. (Deleted by amendment.) 22
Sec. 17. (Deleted by amendment.) 23
Sec. 18. (Deleted by amendment.) 24
Sec. 19. (Deleted by amendment.) 25
Sec. 20. (Deleted by amendment.) 26
Sec. 21. (Deleted by amendment.) 27
Sec. 22. (Deleted by amendment.) 28

– 4 –

- *SB63_R2*
Sec. 23. Chapter 603A of NRS is hereby amended by adding 1
thereto the provisions set forth as sections 24 to 35, inclusive, of this 2
act. 3
Sec. 24. As used in sections 24 to 3 5, inclusive, of this act 4
unless the context otherwise requires, the words and terms defined 5
in sections 25 to 31.9, inclusive, of this act have the meanings 6
ascribed to them in those sections. 7
Sec. 25. “Child” means a natural person who is less than 13 8
years of age. 9
Sec. 25.7. “Consumer” means a natural person who is a 10
resident of this State and who is acting in an individual or 11
personal capacity. The term does not include a natural person who 12
is acting in a commercial or employment capacity. 13
Sec. 26. “Consumer device” means an electronic device that 14
is used primarily for personal, family or household purposes and 15
which connects to the Internet. The term may inc lude, without 16
limitation, a computer, smartphone, electronic tablet, smartwatch, 17
router, Internet gateway, smart television or video game console. 18
Sec. 27. “Controller” means any person who: 19
1. Operates or provides any online service, product or feature 20
that is targeted to persons in this State; and 21
2. Alone or with other persons, determines the purpose and 22
means of processing personal data. 23
Sec. 28. “De-identified data” means data that cannot be 24
reasonably linked to an identified or identifiable person or a 25
particular consumer device that belongs or is linked to an 26
identifiable person. 27
Sec. 28.5. “Known child” means a person whom a controller 28
knows to be a child. 29
Sec. 29. “Online service, product or feature”: 30
1. Means any service, product or feature that is provided 31
online. 32
2. Does not include: 33
(a) A telecommunications service, as that term is defined in 47 34
U.S.C. § 153; 35
(b) Broadband Internet access service, as that term is defined 36
in 47 C.F.R. § 54.400; or 37
(c) The delivery and use of a physical product. 38
Sec. 30. “Personal data”: 39
1. Means any information that is linked or reasonably 40
linkable to an identified or identifiable person. 41
2. Does not include de -identified data or publicly available 42
information. 43
Sec. 31. “Process” means to perform any operation or set of 44
operations, whether performed by manual or automated means, on 45

– 5 –

- *SB63_R2*
personal data, including, without limitation, the collection, use, 1
storage, disclosure, analysis, deletion or modification of personal 2
data. 3
Sec. 31.3. “Processor” means a person who p rocesses data 4
on behalf of a controller. 5
Sec. 31.5. “Publicly available information” means 6
information that: 7
1. Is lawfully made available through the records of a 8
governmental entity; or 9
2. A business has a reasonable basis to believe is made to be 10
lawfully available to the general public: 11
(a) Through a channel of media that is widely distributed; 12
(b) By the consumer to whom the information pertains; or 13
(c) By a person to whom the consumer to whom the 14
information pertains has disclosed the information, unless the 15
consumer has restricted the information to a specific audience. 16
Sec. 31.7. “Sale” means the exchange of personal data with 17
a third party for money or other valuable consideration. The term 18
does not include: 19
1. The disclosure of personal data by a controller to a 20
processor that processes personal data on behalf of the controller; 21
2. The disclosure of personal data to a third party for 22
purposes of providing a product or service requested by a 23
consumer; 24
3. The disclosure or transfer of personal data to an affiliate 25
of the controller; 26
4. The disclosure of information pertaining to a consumer 27
that the consumer: 28
(a) Has i ntentionally made available to the g eneral public 29
through a channel of media that is widely distributed; and 30
(b) Did not restrict to a particular audience; or 31
5. The disclosure or transfer of personal data to a third party 32
as an asset that is a part of a merger, acquisition, bankruptcy or 33
other transaction in which the third party assumes control of all or 34
part of the assets of the controller. 35
Sec. 31.9. “Third party” means a person or entity that is not 36
a consumer, controller, processor or affiliate of a controller or 37
processor. 38
Sec. 32. The provisions of sections 24 to 3 5, inclusive, of this 39
act: 40
1. Do not apply to: 41
(a) A consumer reporting agency, as defined in 15 U.S.C. § 42
1681a(f); 43
(b) Any personally identifiable in formation regulated by the 44
Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq., and the 45

– 6 –

- *SB63_R2*
regulations adopted pursuant thereto, which is collected, 1
maintained or sold as provided in that Act; 2
(c) A person who collects, maintains, or makes sales of 3
personally identifiable information for the purposes of preventing 4
fraud; 5
(d) Any personally identifiable information protected from 6
disclosure under the federal Driver’s Privacy Protection Act of 7
1994, 18 U.S.C. §§ 2721 et seq., which is collected, maintained or 8
sold as provided in that Act; 9
(e) Any consumer health data subject to the provisions of NRS 10
603A.400 to 603A.550, inclusive; 11
(f) A financial institution or an affiliate of a financial 12
institution that is subject to the provisions of the Gramm -Leach-13
Bliley Act, 15 U.S.C. §§ 6801 et seq., or any personally identifiable 14
information regulated by that Act which is collected, maintained 15
or sold as provided in that Act; 16
(g) A controller that, during a calendar year: 17
(1) Processes the personal data of less than 25,000 18
residents of this State; or 19
(2) Processes the personal data of less than 100,000 20
residents of this State and derives less than 50 percent of its gross 21
revenue from the sale of personal data; or 22
(h) A person who is subject to the Health Insurance Portability 23
and Accountability Act of 1996, Public Law 104 -191, and the 24
regulations adopted pursuant thereto, including, without 25
limitation, a covered entity or a business associate of a covered 26
entity, as those terms are defined in 45 C.F.R. § 160.103. 27
2. Do not require a controller to take any action with regard 28
to a child who does not reside in this State. 29
3. Do not apply to the extent that such application would 30
restrict the ability of a controller or processor to: 31
(a) Comply with all app licable federal, state and local laws, 32
regulations and ordinances; 33
(b) Comply with a civil, criminal or regulatory inquiry or 34
investigation conducted by a governmental entity or a subpoena or 35
summons issued by a governmental entity; 36
(c) Cooperate with a law enforcement agenc y concerning 37
conduct or activity that the controller or processor reasonably, and 38
in good faith, believes may violate any federal, state or local law or 39
regulation; 40
(d) Investigate, establish, exercise , prepare for or defend a 41
legal claim; 42
(e) Provide a product or service that is specifically requested by 43
a consumer; 44

– 7 –

- *SB63_R2*
(f) Perform under a contract to which a consumer is a party, 1
including, without limitation, fulfilling the terms of a written 2
warranty; 3
(g) Before entering into a contract with a consumer, take steps 4
requested by the consumer relating to the formation of the 5
contract; 6
(h) Take immediate steps to protect an interest that is essential 7
for the life or physical safety of a consumer or other person , 8
unless those steps are clearly taken for another purpose; 9
(i) Prevent, detect, protect against or respond to: 10
(1) A security incident; 11
(2) An instance of identity theft, fraud or harassment; 12
(3) A malicious or deceptive activity; or 13
(4) Any illegal activity; 14
(j) Preserve the integrity or security of systems or investigate, 15
report or assist in the prosecution of those responsible for any 16
activity described in paragraph (i); 17
(k) Assist in public or peer -reviewed scientific or statistical 18
research which: 19
(1) Is in the public interest; 20
(2) Adheres to all applicable laws relating to privacy and 21
ethics; and 22
(3) Is approved, monitored and governed by a board of 23
institutional review, or a similar entity that independently oversees 24
such research, that determines: 25
(I) Whether the deletion of information used in such 26
research is likely to provide substantial benefits that do not 27
exclusively accrue to the controller; 28
(II) That the expected benefits of the research outweigh 29
any applicable privacy risks; and 30
(III) Whether the controller has implemented 31
reasonable safeguards to mitigate any risks to privacy associated 32
with such research, including, without limitation, risks associated 33
with the re-identification of data; 34
(l) Assist another controller, processor, regulated entity , as 35
defined in NRS 603A.465, or third party with complying with the 36
requirements of NRS 603A.400 to 603A.550, inclusive; or 37
(m) Process personal data for purposes which are in the public 38
interest and relate to public, communit y or population health, but 39
only to the extent that such processing is subject to: 40
(1) Suitable and specific measures to safeguard the rights 41
of the consumer whose personal data is being processed; and 42
(2) All applicable confidentiality requirements im posed by 43
federal, state or local law and overseen by a person subject to such 44
requirements. 45

– 8 –

- *SB63_R2*
Sec. 32.5. A controller that is in possession of any de -1
identified data shall: 2
1. Take reasonable measures to ensure that the d ata cannot 3
be associated with a natural person; 4
2. Publicly commit to maintaining and using the de-identified 5
data without attempting to re-identify the data; and 6
3. Contractually obligate any recipients of de -identified data 7
provided by the controller to comply with the requirements of this 8
section with respect to such data. 9
Sec. 33. 1. Before processing personal data from a known 10
child or collecting the precise geolocation data of a known child, 11
the controller shall o btain verifiable consent from the parent or 12
legal guardian of the child in accordance with the Federal 13
Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501 et 14
seq., and any regulations adopted pursuant thereto. 15
2. A controller shall not process an y personal data of a 16
known child: 17
(a) For the purposes of: 18
(1) Providing targeted advertising to the child; 19
(2) Selling the personal data of the child; or 20
(3) Profiling the child in furtherance of decisions that 21
produce legal or similarly significant effects concerning the child; 22
(b) Unless the processing is reasonably necessary to enable the 23
controller to provide the online service, product or feature offered 24
by the controller; or 25
(c) For longer than is reasonably necessary to enable the 26
controller to provide the online service, product or feature offered 27
by the controller. 28
3. At the time that a controller collects personal data from a 29
known child with the intent of further processing the personal 30
data, the controller shall disclose the purpose of the processing to 31
the child. The controller shall not further process the data except: 32
(a) For the purpose disclosed to the child; or 33
(b) Where the additional processing is reasonab ly necessary 34
for carrying out and compatible with the purpose disclosed to the 35
child. 36
4. A controller shall not collect precise geolocation data from 37
a known child unless: 38
(a) The collection of precise geolocation data is reasonably 39
necessary and limite d in duration to enable the controller to 40
provide the online service, product or feature in connection with 41
which the precise geolocation data is collected; and 42
(b) The controller displays to the child whose precise 43
geolocation data is being collected a n otification, banner, symbol 44
or other indicator that: 45

– 9 –

- *SB63_R2*
(1) Informs the child that his or her precise geolocation 1
data is being collected; and 2
(2) Is displayed at all times during which the controller is 3
collecting the precise geolocation of the child. 4
5. As used in this section: 5
(a) “Decision that produce s legal or similarly significant 6
effects” means a decision made by a controller that results in the 7
provision or denial by the controller of financial and lending 8
services, housing, insurance, enrollme nt in education , criminal 9
justice, employment opportunities, health care services or access to 10
basic necessities, including, without limitation, food and water. 11
(b) “Precise geolocation data” means information derived 12
from technology, including, without l imitation, latitude and 13
longitude coordinates at the level of detail typically provided by a 14
global positioning system, that directly identifies the specific 15
location of a natural person with precision and accuracy within a 16
radius of 1,750 feet. The term does not include: 17
(1) The content of any communication; or 18
(2) Any data generated by or connected to advanced 19
metering infrastructure for utilities or other equipment used by a 20
utility. 21
(c) “Profiling” means a form of automated processing 22
performed on the personal data of a particular person that 23
evaluates, analyzes or predicts the personal aspects relating to the 24
person, including, without limitation, the economic status, health 25
status, personal preferences, interests, reliability, behavior, 26
location or movements of the person. 27
(d) “Targeted advertising”: 28
(1) Means the display of advertisements to a consumer of 29
an online service, product or feature that are selected or 30
recommended based on the personal data obtained from the 31
online activity of the consumer over time and across other online 32
services, products or features that are not affiliated with the online 33
service, product or feature or the controller thereof for the 34
purpose of predicting the preferences or interests of the consumer. 35
(2) Does not include: 36
(I) Advertisements based on the activity of a consumer 37
within online services, products or features operated by the same 38
controller; 39
(II) Advertisements based on inferences drawn 40
exclusively from the specific content of the online service, p roduct 41
or feature that the consumer is currently viewing at the time 42
during which the advertisement is being provided, including 43
inferences drawn from search queries performed by the consumer 44
on the online service, product or feature; 45

– 10 –

- *SB63_R2*
(III) Advertisements directed to the consumer in 1
response to a request for information or feedback submitted by the 2
consumer; or 3
(IV) The processing of personal data performed solely 4
for measuring or reporting the performance, reach or frequency 5
of advertising. 6
Sec. 34. 1. Except as otherwise provided in subsection 3, a 7
controller that offers any online service, product or feature that is 8
directed at children shall: 9
(a) Conduct, for each processing activity in which the 10
controller engages, a data protection assessment; and 11
(b) Retain each data protection assessment co nducted 12
pursuant to paragraph (a) for at least 3 years after the controller 13
ceases to offer the online service, product or feature. 14
2. Each data protection assessment conducted pursuant to 15
paragraph (a) of subsection 1 must: 16
(a) Contain a description of: 17
(1) The purpose of the online service, product or feature to 18
which the data protection assessment pertains; 19
(2) The categories of personal information of known 20
children that are processed by or in connection with the online 21
service, product or feature; and 22
(3) Each purpose for which the controller processes the 23
personal data of known children. 24
(b) Identify the: 25
(1) Benefits to the controller, the consumers of the online 26
services, products or features offered by the controller , including, 27
without limitation, such consumers who are known children, and 28
the public which may result , either directly or indirectly, from 29
processing the data of known children; and 30
(2) The potential risks to the rights and safety of the known 31
children whose data is processed by the controller, as mitigated by 32
the safeguards that the controller may reasonably implement to 33
reduce such risks, which may include , without limitatio n, using 34
de-identified data in place of personal data; 35
(c) Weigh the benefits identified pursuant to subparagraph (1) 36
of paragraph (b) against the risks identified pursuant to 37
subparagraph (2) of paragraph (b), factoring in: 38
(1) The reasonable expectati ons of children who use the 39
online service, product or feature and the reasonable expectations 40
of the parents and legal guardians of such children; 41
(2) The context in which the controller processes the data 42
of known children; and 43
(3) The relationship between the controller and the known 44
children whose data the controller will process. 45

– 11 –

- *SB63_R2*
3. A controller shall be deemed to have satisfied the 1
requirements of paragraph (a) of subsection 1 if the controller has 2
conducted: 3
(a) A single data protection assessment that addresses a 4
comparable set of data processing activities, each of which must 5
be similar, in which the controller engages. 6
(b) A data protection assessment in accordance with the laws 7
or regulations of another state or the Federal Government if the 8
assessment has a reasonably comparable scope and effect to an 9
assessment that the controller would otherwise be required to 10
conduct pursuant to paragraph (a) of subsection 1. 11
4. The Attorney General may request any data protection 12
assessment conducted pursuant to this section if the Attorney 13
General believes that the content of such an assessment is relevant 14
to an ongoing investigation of a potential violation of section 33 of 15
this act. A controller shall provide to the Attorney General any 16
data protection assessment that is requested pursuant to this 17
subsection. 18
5. A data protection assessment provided to the Attorney 19
General pursuant to subsection 4 is confidential and is not a 20
public book or record within the meaning of NRS 239.010. 21
6. The disclosure of a data protection assessment to the 22
Attorney General, the Office of the Attorney General or any other 23
officer or employee of the Office of the Attorney General pursuant 24
to subsection 4 does not constitute a waiver of the attorney -client 25
privilege or work product protection with respect to the 26
information contained within any such data protection 27
assessment. 28
Sec. 35. 1. Upon determining that a controller has violated 29
or is violating any provision of sections 24 to 35, inclusive, of this 30
act, the Attorney General shall provide the controller with written 31
notice that identifies the specific provision of sections 24 to 3 5, 32
inclusive, of this act that the Attorney General determines that the 33
controller is violatin g or has violated and the specific facts 34
underlying that determination. 35
2. Not later than 30 days after receiving a notice pursuant to 36
subsection 1, a controller shall remedy the violation described in 37
the notice. 38
3. Failure by a controller to comply w ith the requirements of 39
subsection 2 constitutes a deceptive trade practice for the purposes 40
of NRS 598.0903 to 598.0999, inclusive. 41
4. The Attorney General has the exclusive authority to 42
enforce the provisions of sections 24 to 35, inclusive, of this act. 43
5. Nothing in sections 24 to 35, inclusive, of this act shall be 44
construed to create a private right of action. 45

– 12 –

- *SB63_R2*
Sec. 36. NRS 239.010 is hereby amended to read as follows: 1
239.010 1. Except as otherwise provided in this section and 2
NRS 1.4683, 1.4687, 1A.110, 3.2203, 41.0397, 41.071, 49.095, 3
49.293, 62D.420, 62D.440, 62E.516, 62E.620, 62H.025, 62H.030, 4
62H.170, 62H.220, 62H.320, 75A.100, 75A.150, 76.160, 78.152, 5
80.113, 81.850, 82.183, 86.246, 86.54615, 87.515, 87.54 13, 6
87A.200, 87A.580, 87A.640, 88.3355, 88.5927, 88.6067, 88A.345, 7
88A.7345, 89.045, 89.251, 90.730, 91.160, 116.757, 116A.270, 8
116B.880, 118B.026, 119.260, 119.265, 119.267, 119.280, 9
119A.280, 119A.653, 119A.677, 119B.370, 119B.382, 120A.640, 10
120A.690, 125.130, 125B.140, 126.141, 126.161, 126.163, 126.730, 11
127.007, 127.057, 127.130, 127.140, 127.2817, 128.090, 130.312, 12
130.712, 136.050, 159.044, 159A.044, 164.041, 172.075, 172.245, 13
176.01334, 176.01385, 176.015, 176.0625, 176.09129, 176.156, 14
176A.630, 178. 39801, 178.4715, 178.5691, 178.5717, 179.495, 15
179A.070, 179A.165, 179D.160, 180.600, 200.3771, 200.3772, 16
200.5095, 200.604, 202.3662, 205.4651, 209.392, 209.3923, 17
209.3925, 209.419, 209.429, 209.521, 211A.140, 213.010, 213.040, 18
213.095, 213.131, 217.105, 2 17.110, 217.464, 217.475, 218A.350, 19
218E.625, 218F.150, 218G.130, 218G.240, 218G.350, 218G.615, 20
224.240, 226.462, 226.796, 228.270, 228.450, 228.495, 228.570, 21
231.069, 231.1285, 231.1473, 232.1369, 233.190, 237.300, 22
239.0105, 239.0113, 239.014, 239B.026, 2 39B.030, 239B.040, 23
239B.050, 239C.140, 239C.210, 239C.230, 239C.250, 239C.270, 24
239C.420, 240.007, 241.020, 241.030, 241.039, 242.105, 244.264, 25
244.335, 247.540, 247.545, 247.550, 247.560, 250.087, 250.130, 26
250.140, 250.145, 250.150, 268.095, 268.0978, 268. 490, 268.910, 27
269.174, 271A.105, 281.195, 281.805, 281A.350, 281A.680, 28
281A.685, 281A.750, 281A.755, 281A.780, 284.4068, 284.4086, 29
286.110, 286.118, 287.0438, 289.025, 289.080, 289.387, 289.830, 30
293.4855, 293.5002, 293.503, 293.504, 293.558, 293.5757, 293.870, 31
293.906, 293.908, 293.909, 293.910, 293B.135, 293D.510, 331.110, 32
332.061, 332.351, 333.333, 333.335, 338.070, 338.1379, 338.1593, 33
338.1725, 338.1727, 348.420, 349.597, 349.775, 353.205, 34
353A.049, 353A.085, 353A.100, 353C.240, 353D.250, 360.240, 35
360.247, 360.255, 360.755, 361.044, 361.2242, 361.610, 365.138, 36
366.160, 368A.180, 370.257, 370.327, 372A.080, 378.290, 378.300, 37
379.0075, 379.008, 379.1495, 385A.830, 385B.100, 387.626, 38
387.631, 388.1455, 388.259, 388.501, 388.503, 388.513, 388.750, 39
388A.247, 3 88A.249, 391.033, 391.035, 391.0365, 391.120, 40
391.925, 392.029, 392.147, 392.264, 392.271, 392.315, 392.317, 41
392.325, 392.327, 392.335, 392.850, 393.045, 394.167, 394.16975, 42
394.1698, 394.447, 394.460, 394.465, 396.1415, 396.1425, 396.143, 43
396.159, 396.329 5, 396.405, 396.525, 396.535, 396.9685, 44
398A.115, 408.3885, 408.3886, 408.3888, 408.5484, 412.153, 45

– 13 –

- *SB63_R2*
414.280, 416.070, 422.2749, 422.305, 422A.342, 422A.350, 1
425.400, 427A.1236, 427A.872, 427A.940, 432.028, 432.205, 2
432B.175, 432B.280, 432B.290, 432B.4018, 4 32B.407, 432B.430, 3
432B.560, 432B.5902, 432C.140, 432C.150, 433.534, 433A.360, 4
439.4941, 439.4988, 439.5282, 439.840, 439.914, 439A.116, 5
439A.124, 439B.420, 439B.754, 439B.760, 439B.845, 440.170, 6
441A.195, 441A.220, 441A.230, 442.330, 442.395, 442.735, 7
442.774, 445A.665, 445B.570, 445B.7773, 449.209, 449.245, 8
449.4315, 449A.112, 450.140, 450B.188, 450B.805, 453.164, 9
453.720, 458.055, 458.280, 459.050, 459.3866, 459.555, 459.7056, 10
459.846, 463.120, 463.15993, 463.240, 463.3403, 463.3407, 11
463.790, 467.1005, 4 80.535, 480.545, 480.935, 480.940, 481.063, 12
481.091, 481.093, 482.170, 482.368, 482.5536, 483.340, 483.363, 13
483.575, 483.659, 483.800, 484A.469, 484B.830, 484B.833, 14
484E.070, 485.316, 501.344, 503.452, 522.040, 534A.031, 561.285, 15
571.160, 584.655, 587.877, 598.0964, 598.098, 598A.110, 16
598A.420, 599B.090, 603.070, 603A.210, 604A.303, 604A.710, 17
604D.500, 604D.600, 612.265, 616B.012, 616B.015, 616B.315, 18
616B.350, 618.341, 618.425, 622.238, 622.310, 623.131, 623A.137, 19
624.110, 624.265, 624.327, 625.425, 625A.185, 628.418, 628B.230, 20
628B.760, 629.043, 629.047, 629.069, 630.133, 630.2671, 21
630.2672, 630.2673, 630.2687, 630.30665, 630.336, 630A.327, 22
630A.555, 631.332, 631.368, 632.121, 632.125, 632.3415, 23
632.3423, 632.405, 633.283, 633.301, 633.427, 633.4715, 633.4716, 24
633.4717, 633.524, 634.055, 634.1303, 634.214, 634A.169, 25
634A.185, 634B.730, 635.111, 635.158, 636.262, 636.342, 637.085, 26
637.145, 637B.192, 637B.288, 638.087, 638.089, 639.183, 27
639.2485, 639.570, 640.075, 640.152, 640A.185, 640A.220, 28
640B.405, 640B.73 0, 640C.580, 640C.600, 640C.620, 640C.745, 29
640C.760, 640D.135, 640D.190, 640E.225, 640E.340, 641.090, 30
641.221, 641.2215, 641A.191, 641A.217, 641A.262, 641B.170, 31
641B.281, 641B.282, 641C.455, 641C.760, 641D.260, 641D.320, 32
642.524, 643.189, 644A.870, 645.180 , 645.625, 645A.050, 33
645A.082, 645B.060, 645B.092, 645C.220, 645C.225, 645D.130, 34
645D.135, 645G.510, 645H.320, 645H.330, 647.0945, 647.0947, 35
648.033, 648.197, 649.065, 649.067, 652.126, 652.228, 653.900, 36
654.110, 656.105, 657A.510, 661.115, 665.130, 665.13 3, 669.275, 37
669.285, 669A.310, 670B.680, 671.365, 671.415, 673.450, 673.480, 38
675.380, 676A.340, 676A.370, 677.243, 678A.470, 678C.710, 39
678C.800, 679B.122, 679B.124, 679B.152, 679B.159, 679B.190, 40
679B.285, 679B.690, 680A.270, 681A.440, 681B.260, 681B.410, 41
681B.540, 683A.0873, 685A.077, 686A.289, 686B.170, 686C.306, 42
687A.060, 687A.115, 687B.404, 687C.010, 688C.230, 688C.480, 43
688C.490, 689A.696, 692A.117, 692C.190, 692C.3507, 692C.3536, 44
692C.3538, 692C.354, 692C.420, 693A.480, 693A.615, 696B.550, 45

– 14 –

- *SB63_R2*
696C.120, 703 .196, 704B.325, 706.1725, 706A.230, 710.159, 1
711.600, and section 3 4 of this act, sections 35, 38 and 41 of 2
chapter 478, Statutes of Nevada 2011 and section 2 of chapter 391, 3
Statutes of Nevada 2013 and unless otherwise declared by law to be 4
confidential, all public books and public records of a governmental 5
entity must be open at all times during office hours to inspection by 6
any person, and may be fully copied or an abstract or memorandum 7
may be prepared from those public books and public records. Any 8
such copies, abstracts or memoranda may be used to supply the 9
general public with copies, abstracts or memoranda of the records or 10
may be used in any other way to the advantage of the governmental 11
entity or of the general public. This section does not superse de or in 12
any manner affect the federal laws governing copyrights or enlarge, 13
diminish or affect in any other manner the rights of a person in any 14
written book or record which is copyrighted pursuant to federal law. 15
2. A governmental entity may not reject a book or record 16
which is copyrighted solely because it is copyrighted. 17
3. A governmental entity that has legal custody or control of a 18
public book or record shall not deny a request made pursuant to 19
subsection 1 to inspect or copy or receive a copy of a public book or 20
record on the basis that the requested public book or record contains 21
information that is confidential if the governmental entity can 22
redact, delete, conceal or separate, including, without limitation, 23
electronically, the confidential info rmation from the information 24
included in the public book or record that is not otherwise 25
confidential. 26
4. If requested, a governmental entity shall provide a copy of a 27
public record in an electronic format by means of an electronic 28
medium. Nothing in thi s subsection requires a governmental entity 29
to provide a copy of a public record in an electronic format or by 30
means of an electronic medium if: 31
(a) The public record: 32
(1) Was not created or prepared in an electronic format; and 33
(2) Is not available in an electronic format; or 34
(b) Providing the public record in an electronic format or by 35
means of an electronic medium would: 36
(1) Give access to proprietary software; or 37
(2) Require the production of information that is confidential 38
and that cannot b e redacted, deleted, concealed or separated from 39
information that is not otherwise confidential. 40
5. An officer, employee or agent of a governmental entity who 41
has legal custody or control of a public record: 42
(a) Shall not refuse to provide a copy of that public record in the 43
medium that is requested because the officer, employee or agent has 44

– 15 –

- *SB63_R2*
already prepared or would prefer to provide the copy in a different 1
medium. 2
(b) Except as otherwise provided in NRS 239.030, shall, upon 3
request, prepare the copy o f the public record and shall not require 4
the person who has requested the copy to prepare the copy himself 5
or herself. 6
Sec. 37. 1. A controller is not required to co nduct a data 7
protection assessment pursuant to section 3 4 of this act for any 8
processing activity which the controller engaged in, created or 9
generated before January 1, 2026, but is required to co nduct a data 10
protection assessment for any processing activity which the 11
controller engages in , creates or generate s on or after January 1, 12
2026. 13
2. As used in this section: 14
(a) “Controller” has the meaning ascribed to it in section 2 7 of 15
this act. 16
(b) “Process” has the meaning ascribed to it in section 3 1 of this 17
act. 18
Sec. 38. 1. This section becomes effective upon passage and 19
approval. 20
2. Sections 1 to 37, inclusive, of this act become effective: 21
(a) Upon passage and approval for the purpose of adopting any 22
regulations and performing any other preparatory administrative 23
tasks that are necessary to carry out the provisions of this act; and 24
(b) On January 1, 2026, for all other purposes. 25

H