DPO SchoolDPO School

Delaware Personal Data Privacy Act

Delaware privacy law (DPDPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, publish a privacy notice and offer a clear opt-out link. Universal opt-out preference signals must be honoured from 1 Jan 2026. Controllers handling data of at least 100,000 consumers must carry out data protection assessments for high-risk processing (50,000 from 1 Jan 2027).

Key points

  1. Data minimisation: collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes; from 2027, processing limited to what is reasonably necessary and proportional.

    Section: § 12D-106(a)(1)

  2. Privacy notice must list categories of data, purposes, how to exercise and appeal rights, categories of data shared and of third parties, and an active email or online contact.

    Section: § 12D-106(c)

  3. Sales and targeted advertising must be disclosed clearly with the way to opt out, and a clear website opt-out link is required.

    Section: § 12D-106(d), (e)(1)a.1

  4. Universal opt-out preference signals for targeted advertising and sale must be honoured no later than 1 Jan 2026.

    Section: § 12D-106(e)(1)a.2

  5. Consent must be revocable as easily as given, with processing stopped within 15 days.

    Section: § 12D-106(a)(6)

  6. Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive data, for controllers with at least 100,000 consumers, for activities from 1 Jul 2025; the threshold falls to 50,000 from 2027.

    Section: § 12D-108(a), (f)

  7. From 1 Jan 2027 controllers must have binding contracts with, and exercise reasonable due diligence over, third parties to whom they disclose personal data.

    Section: § 12D-106(a)(10)-(11) (eff. Jan. 1, 2027)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Delaware statute

Reference material, not legal advice.