Does Delaware have a comprehensive privacy law? Yes. The Delaware Personal Data Privacy Act has been in effect since January 1, 2025; amendments in HB 380, signed September 2, 2026, take effect on January 1, 2027.
- Status: In Effect
- Law: Delaware Personal Data Privacy Act (HB 154, 2023; 84 Del. Laws c. 197; 6 Del. C. ch. 12D), as amended by HB 380 (2026; 85 Del. Laws c. 463)
- Signed: September 11, 2023 · Effective: January 1, 2025 (HB 380 amendments: January 1, 2027)
- Applies to: Persons that conduct business in Delaware or target products or services to Delaware residents and that, in the preceding calendar year, controlled or processed the personal data of at least 35,000 consumers (excluding payment-only data), or of at least 10,000 consumers while deriving more than 20% of gross revenue from the sale of personal data. From January 1, 2027: 10,000 and 5,000 consumers, plus third parties that acquire personal data from a controller
- Cure period: No longer mandatory. A 60-day cure period applied from January 1 to December 31, 2025; since January 1, 2026, the Department of Justice may decide whether to offer one
- Enforcement: Delaware Department of Justice (exclusive); a violation is an unlawful practice under the Consumer Fraud Act, with civil penalties of up to $10,000 per wilful violation; no private right of action
- Last verified: November 4, 2026 · Official source: 6 Del. C. chapter 12D
- Related: Delaware Personal Data Privacy Act (DPDPA) guide; State privacy laws that took effect in 2025
Delaware Personal Data Privacy Act Overview
The Delaware Personal Data Privacy Act is Delaware’s comprehensive consumer privacy law. The law was signed in 2023 and took effect on January 1, 2025.
The law gives Delaware residents rights over their personal data and creates obligations for businesses that collect, use, sell, or share covered personal data. It follows the general structure of other state privacy laws, including laws in Connecticut and Virginia, but it applies at relatively low thresholds. This means some organizations may fall under the Delaware law even if they are not covered by privacy laws in larger states.
The Delaware law is often referred to as the DPDPA. It applies to certain businesses that conduct business in Delaware or provide products or services targeted to Delaware residents.
Delaware DPDPA 2026 Amendment Update
Delaware lawmakers advanced HB 380 in 2026. HB 380 is not a separate privacy law. It amends the existing Delaware Personal Data Privacy Act.
Governor Matt Meyer signed HB 380 on September 2, 2026 (85 Del. Laws c. 463). The amendments take effect January 1, 2027, and significantly update the DPDPA and make Delaware’s privacy law broader in several important areas.
From January 1, 2027, the amendments lower the main applicability thresholds and add a new category for third parties that acquire personal data from controllers. That change could affect vendors, service providers, advertising partners, data brokers, analytics providers, and other companies that receive Delaware consumer data from covered businesses.
HB 380 would also narrow parts of the GLBA-related exemption, add third-party contracting duties, and require greater due diligence where personal data is sold or disclosed. It would also expand requirements around profiling, automated decisions, sensitive data, and data protection assessments.
With HB 380 signed, many businesses should revisit their Delaware privacy analysis before the amendment’s effective date. This is especially important for organizations that previously concluded they were outside the DPDPA because of consumer thresholds, GLBA-related assumptions, or their role as a downstream recipient of personal data.
Who Must Comply With the Delaware Privacy Law?
The DPDPA applies to persons that conduct business in Delaware or produce products or services targeted to Delaware residents and meet one of the law’s thresholds.
Under the original law, a business may be covered if it controls or processes the personal data of at least 35,000 Delaware consumers during the preceding calendar year. A business may also be covered if it controls or processes the personal data of at least 10,000 Delaware consumers and derives more than 20% of its gross revenue from the sale of personal data.
The law excludes personal data processed solely for completing a payment transaction from the main 35,000-consumer threshold.
Under HB 380, effective January 1, 2027, those thresholds change. The first threshold drops to 10,000 consumers. The second drops to 5,000 consumers when more than 20% of gross revenue comes from selling personal data. The amendments also cover third parties that acquire personal data from a controller.
Consumer Rights Under the Delaware DPDPA
The DPDPA gives Delaware consumers several rights over their personal data.
Consumers may request access to their personal data. They may also request correction of inaccurate personal data, deletion of personal data, and a portable copy of personal data processed by a controller.
Consumers also have the right to opt out of certain uses of their personal data. This includes targeted advertising, the sale of personal data, and certain types of profiling.
The law also gives consumers the right to obtain a list of third parties to which the controller has disclosed their personal data, subject to certain limits.
Sensitive Data Requirements
The DPDPA requires consent before processing sensitive data. Sensitive data includes categories such as precise geolocation data, biometric data, genetic data, children’s data, and certain data that reveals protected or highly personal characteristics.
Businesses covered by the law should review where sensitive data is collected, how consent is obtained, and whether consent can be documented. They should also confirm that privacy notices and request workflows clearly explain how sensitive data is handled.
HB 380 would expand the sensitive data framework further. It would add new details around sensitive data, inferences, neural data, financial access information, government identification numbers, and the sale of sensitive data.
Controller Requirements
Controllers must limit personal data processing to what is adequate, relevant, and reasonably necessary for the disclosed purposes. They must also maintain reasonable administrative, technical, and physical safeguards to protect personal data.
Controllers must provide a clear privacy notice. The notice should explain what categories of personal data are processed, why the data is processed, how consumers can exercise their rights, and how the controller can be contacted.
If a controller sells personal data, processes personal data for targeted advertising, or uses personal data for certain profiling, the controller must clearly disclose that activity and explain how consumers can opt out.
Controllers must also establish secure and reliable methods for consumers to submit rights requests. A business should not treat these request channels as a simple website form. The process needs to support identity verification, response tracking, appeal handling, and recordkeeping.
Processor and Third-Party Requirements
The DPDPA requires contracts between controllers and processors. These contracts must define the processing instructions, the nature and purpose of processing, the type of data processed, the duration of processing, and each party’s rights and obligations.
HB 380 would make third-party oversight more important. The amendment would require binding contractual terms where personal data is disclosed to third parties. It would also require reasonable due diligence for third parties that receive personal data, including data disclosed in a sale or for targeted advertising.
For businesses, this would make Delaware privacy compliance more closely tied to vendor risk management. Organizations should know which third parties receive Delaware consumer data, why they receive it, what contractual limits apply, and whether the third party can meet DPDPA requirements.
Data Protection Assessments
The DPDPA requires certain controllers to conduct and document data protection assessments for processing activities that present a heightened risk of harm.
These assessments may apply to targeted advertising, sale of personal data, processing sensitive data, and certain profiling activities. The Delaware Attorney General may request relevant assessments during an investigation.
HB 380 would lower the threshold for assessment duties and add more detailed requirements for profiling that supports automated decisions with legal or similarly significant effects. Businesses using automated scoring, eligibility tools, advertising models, or profiling systems should review whether these activities trigger Delaware assessment obligations.
Enforcement
The Delaware Department of Justice enforces the DPDPA. The law does not create a private right of action.
The DPDPA included an initial cure period. That period expired on December 31, 2025. Beginning January 1, 2026, the Department of Justice is no longer required to provide an opportunity to cure before enforcement. The Department may still consider whether a cure opportunity is appropriate, but covered businesses should not rely on a guaranteed cure period.
This makes documentation more important. Businesses should be able to show how they handle consumer requests, consent, opt-outs, vendor oversight, sensitive data, data protection assessments, and privacy notices.
History of the Delaware DPDPA
At the end of 2025, as Delaware’s Personal Data Privacy Act (DPDPA) approached its first full year in effect, it reached a key enforcement milestone.
The DPDPA includes a temporary right to cure, allowing organizations an opportunity to address alleged violations before the Delaware Department of Justice initiates enforcement action. This cure period expired on December 31, 2025.
Since January 1, 2026, the Attorney General has no longer been required to provide a cure opportunity before pursuing enforcement. This transition marks a shift from an initial implementation phase to a standard enforcement posture, aligning Delaware with several other states that have already phased out cure periods.
For organizations operating in or targeting Delaware residents, this change does not introduce new substantive obligations. However, it does increase the importance of having operational privacy controls, documentation, and response processes in place.
Delaware DPDPA is Signed Into Law in 2023
Delaware Governor John Carney signed the Delaware Personal Data Privacy Act (DPDPA) into law on September 11, 2023.
The DPDPA closely aligns with the privacy laws of Connecticut and Virginia. The law took effect on January 1, 2025.
When it passed in 2023, Delaware was the most recent state to pass a comprehensive privacy bill. With the Governor’s signature, Delaware joined the growing number of states that have enacted consumer data privacy legislation.
Stay updated with the latest news on the privacy scene by navigating our U.S. privacy law tracker here.
History of the Delaware Personal Data Privacy Act
The Delaware Personal Data Privacy Act, identified as HB 154 and sponsored by Rep. Krista Griffith, establishes a thorough framework of consumer protections, giving people more control over their personal data collection and increasing transparency about how that data is used.
This is the second time a Delaware online privacy and protection act was introduced in the state legislature.
Last year in May 2022, House Bill 262, sponsored by Griffith as well, proposed that data brokers be required to register with the state and provide information on how they use customer data.
Although it passed smoothly in the House with a vote of 27 to 13, it didn’t get a hearing in a Senate committee.
“We know this is a complicated bill with many provisions,” Owen Lefkon, director of the Fraud and Consumer Protection Division of the Delaware Department of Justice, said. “But at its core, it’s simple. We have to codify what consumers already expect. That their data is their own and that they should have some rights to be able to access and control it.”