DPO SchoolDPO School

Delaware Personal Data Privacy Act

Delaware privacy law (DPDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act applies to persons doing business in Delaware or targeting Delaware residents that, in the preceding calendar year, handled personal data of at least 35,000 consumers (payment-only data excluded), or at least 10,000 consumers while earning more than 20% of gross revenue from selling personal data. From 1 Jan 2027 these figures fall to 10,000 and 5,000, and third parties that acquire personal data from a controller are covered. Unlike most states, nonprofits and higher education institutions are generally covered, and HIPAA is a data-level exemption only.

Key points

  1. Thresholds until 31 Dec 2026: 35,000 consumers, or 10,000 consumers plus more than 20% of gross revenue from sales.

    Section: § 12D-103(a)(1)-(2)

  2. From 1 Jan 2027: 10,000 consumers, or 5,000 consumers plus more than 20% of gross revenue from sales; third parties that acquire personal data from a controller are also covered.

    Section: § 12D-103(a)(1)-(3) (eff. Jan. 1, 2027)

  3. Government bodies are exempt, but institutions of higher education are expressly not exempt.

    Section: § 12D-103(b)(1)

  4. Until 2026, GLBA financial institutions and affiliates are exempt at entity level to the extent subject to GLBA Title V; GLBA data is also exempt. From 2027 the entity exemption is limited to banks, credit unions, savings associations, insurers and certain securities firms, with GLBA data exempt at data level.

    Section: § 12D-103(b)(2), (c)(14); § 12D-103(b)(2), (5), (6) (eff. Jan. 1, 2027)

  5. Only nonprofits dedicated exclusively to preventing insurance crime are exempt, so other nonprofits are covered.

    Section: § 12D-103(b)(3)

  6. HIPAA protected health information is exempt as data; there is no entity-level exemption for covered entities or business associates.

    Section: § 12D-103(c)(1)

  7. Employee, applicant and contractor data used in that role is exempt, and the definition of consumer excludes people acting in a commercial or employment context.

    Section: § 12D-103(c)(11); § 12D-102

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Delaware statute

Reference material, not legal advice.