Comprehensive state privacy law
Delaware privacy law
Delaware Personal Data Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Del. Code Ann. tit. 6, §§ 12D-101 to 12D-111
- Official text
- https://delcode.delaware.gov/title6/c012d/index.html
- Enacted
- September 11, 2023. 84 Del. Laws c. 197 (HB 154, 152nd General Assembly)
- In force
- January 1, 2025
- Effective dates
- January 1, 2025: main provisions
- July 1, 2025: data protection assessments apply to processing activities created or generated on or after this date (§ 12D-108(f))
- January 1, 2026: universal opt-out preference signals must be honoured (§ 12D-106(e)(1)a.2); mandatory 60-day cure period ended 31 Dec 2025 and cure became discretionary (§ 12D-111(b), (c))
- January 1, 2027: HB 380 amendments (85 Del. Laws c. 463) take effect: lower thresholds, narrower GLBA exemption, wider sensitive data, inferences and third-party list rights, third-party contracts and due diligence
- Enforcer
- Department of Justice (Attorney General), exclusive
- Private right of action
- No. No private right of action under the Act (§ 12D-111(d)).
- Cure period
- 60 days. Ended December 31, 2025. From 1 Jan to 31 Dec 2025 the Department of Justice had to give notice and 60 days to cure where a cure was possible. From 1 Jan 2026 a cure opportunity is at the Department's discretion, weighing listed factors such as the number of violations, the size of the business and prior violations. (§ 12D-111(b), (c))
- Rulemaking
- No. The Act gives no agency rulemaking power.
Amendments
- 85 Del. Laws c. 463 (HB 380, 153rd General Assembly), signed 2026-09-02 (in force January 1, 2027). Lowers the applicability thresholds from 35,000 to 10,000 consumers and from 10,000 to 5,000 consumers (with over 20% of revenue from sales), and covers third parties that acquire personal data from a controller; replaces the GLBA entity exemption with a data-level exemption plus entity exemptions for banks, credit unions, insurers and certain securities firms; widens sensitive data (inferences, neural data, financial account credentials, certain government identifiers); adds a right to know inferences and whether profiling is used for significant decisions, and a right to a list of specific third parties; requires binding contracts and reasonable due diligence for disclosures to third parties and adds duties for third parties (§ 12D-107A); allows sale of sensitive data only in narrow conditions with consent; lowers the assessment threshold from 100,000 to 50,000 consumers and adds impact assessments for profiling used in significant decisions.
Topics
- ApplicabilityThe Act applies to persons doing business in Delaware or targeting Delaware residents that, in the preceding calendar year, handled personal data of at least 35,000 consumers (payment-only data excluded), or at least 10,000 consumers while earning more than 20% of gross revenue from selling personal data. From 1 Jan 2027 these figures fall to 10,000 and 5,000, and third parties that acquire personal data from a controller are covered. Unlike most states, nonprofits and higher education institutions are generally covered, and HIPAA is a data-level exemption only.
- Consumer rightsConsumers may confirm and access, correct, delete, obtain a portable copy, obtain a list of the categories of third parties that received their data, and opt out of targeted advertising, sale and solely automated profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. From 1 Jan 2027 access covers inferences and whether profiling is used for significant decisions, and the third-party list must name specific third parties.
- Sensitive dataSensitive data may be processed only with the consumer's opt-in consent, and data about a known child (under 13, as defined by COPPA) needs a parent's consent. Delaware protects teenagers more than most states: a controller that knows or wilfully disregards that a consumer is 13 to 17 may not sell the data or use it for targeted advertising without consent. From 1 Jan 2027 the definition widens and sensitive data processing must also be reasonably necessary and proportionate.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, publish a privacy notice and offer a clear opt-out link. Universal opt-out preference signals must be honoured from 1 Jan 2026. Controllers handling data of at least 100,000 consumers must carry out data protection assessments for high-risk processing (50,000 from 1 Jan 2027).
- ProcessorsProcessors must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, subcontractor flow-down after a chance to object, and cooperation with assessments. From 2027 the contract must also state each specific purpose with particularity.
- EnforcementThe Department of Justice enforces the Act exclusively, and there is no private right of action. The mandatory 60-day cure period applied only in 2025; since 1 Jan 2026 a cure opportunity is discretionary. A violation is an unlawful practice under the consumer fraud law, which allows civil penalties of up to $10,000 for each wilful violation.
Sources
- Delaware Code, Title 6, Chapter 12D (both the current text and the text effective 1 Jan 2027)
- HB 380 (153rd GA) bill detail: signed 9/2/26, chapter 85:463, effective 1/1/27
- HB 154 (152nd GA) bill detail: signed 9/11/23, chapter 84:197, effective 1/1/25
- Delaware Code, Title 6, Chapter 25, Subchapter II (Consumer Fraud), § 2522 civil penalty
- Law-firm and tracker alerts on HB 380 (used only to locate the official sources)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Delaware statute
Reference material, not legal advice.