---
title: "Delaware privacy law (DPDPA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/delaware/applicability"
source: "https://delcode.delaware.gov/title6/c012d/index.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Delaware Personal Data Privacy Act

# Delaware privacy law (DPDPA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Act applies to persons doing business in Delaware or targeting Delaware residents that, in the preceding calendar year, handled personal data of at least 35,000 consumers (payment-only data excluded), or at least 10,000 consumers while earning more than 20% of gross revenue from selling personal data. From 1 Jan 2027 these figures fall to 10,000 and 5,000, and third parties that acquire personal data from a controller are covered. Unlike most states, nonprofits and higher education institutions are generally covered, and HIPAA is a data-level exemption only.

## Key points

1. Thresholds until 31 Dec 2026: 35,000 consumers, or 10,000 consumers plus more than 20% of gross revenue from sales.

   Section: [§ 12D-103(a)(1)-(2)](https://delcode.delaware.gov/title6/c012d/index.html)

2. From 1 Jan 2027: 10,000 consumers, or 5,000 consumers plus more than 20% of gross revenue from sales; third parties that acquire personal data from a controller are also covered.

   Section: [§ 12D-103(a)(1)-(3) (eff. Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

3. Government bodies are exempt, but institutions of higher education are expressly not exempt.

   Section: [§ 12D-103(b)(1)](https://delcode.delaware.gov/title6/c012d/index.html)

4. Until 2026, GLBA financial institutions and affiliates are exempt at entity level to the extent subject to GLBA Title V; GLBA data is also exempt. From 2027 the entity exemption is limited to banks, credit unions, savings associations, insurers and certain securities firms, with GLBA data exempt at data level.

   Section: [§ 12D-103(b)(2), (c)(14); § 12D-103(b)(2), (5), (6) (eff. Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

5. Only nonprofits dedicated exclusively to preventing insurance crime are exempt, so other nonprofits are covered.

   Section: [§ 12D-103(b)(3)](https://delcode.delaware.gov/title6/c012d/index.html)

6. HIPAA protected health information is exempt as data; there is no entity-level exemption for covered entities or business associates.

   Section: [§ 12D-103(c)(1)](https://delcode.delaware.gov/title6/c012d/index.html)

7. Employee, applicant and contractor data used in that role is exempt, and the definition of consumer excludes people acting in a commercial or employment context.

   Section: [§ 12D-103(c)(11); § 12D-102](https://delcode.delaware.gov/title6/c012d/index.html)

## Sources

- [Delaware Code, Title 6, Chapter 12D (both the current text and the text effective 1 Jan 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Delaware statute](https://delcode.delaware.gov/title6/c012d/index.html)

Reference material, not legal advice.

## Other topics for Delaware

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/delaware/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/delaware/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/delaware/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/delaware/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/delaware/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Delaware](https://dposchool.com/state-privacy-laws/state/delaware) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/delaware/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents