---
title: "Delaware privacy law (DPDPA): controller duties"
canonical: "https://dposchool.com/state-privacy-laws/state/delaware/controller-duties"
source: "https://delcode.delaware.gov/title6/c012d/index.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Delaware Personal Data Privacy Act

# Delaware privacy law (DPDPA): controller duties

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, publish a privacy notice and offer a clear opt-out link. Universal opt-out preference signals must be honoured from 1 Jan 2026. Controllers handling data of at least 100,000 consumers must carry out data protection assessments for high-risk processing (50,000 from 1 Jan 2027).

## Key points

1. Data minimisation: collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes; from 2027, processing limited to what is reasonably necessary and proportional.

   Section: [§ 12D-106(a)(1)](https://delcode.delaware.gov/title6/c012d/index.html)

2. Privacy notice must list categories of data, purposes, how to exercise and appeal rights, categories of data shared and of third parties, and an active email or online contact.

   Section: [§ 12D-106(c)](https://delcode.delaware.gov/title6/c012d/index.html)

3. Sales and targeted advertising must be disclosed clearly with the way to opt out, and a clear website opt-out link is required.

   Section: [§ 12D-106(d), (e)(1)a.1](https://delcode.delaware.gov/title6/c012d/index.html)

4. Universal opt-out preference signals for targeted advertising and sale must be honoured no later than 1 Jan 2026.

   Section: [§ 12D-106(e)(1)a.2](https://delcode.delaware.gov/title6/c012d/index.html)

5. Consent must be revocable as easily as given, with processing stopped within 15 days.

   Section: [§ 12D-106(a)(6)](https://delcode.delaware.gov/title6/c012d/index.html)

6. Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive data, for controllers with at least 100,000 consumers, for activities from 1 Jul 2025; the threshold falls to 50,000 from 2027.

   Section: [§ 12D-108(a), (f)](https://delcode.delaware.gov/title6/c012d/index.html)

7. From 1 Jan 2027 controllers must have binding contracts with, and exercise reasonable due diligence over, third parties to whom they disclose personal data.

   Section: [§ 12D-106(a)(10)-(11) (eff. Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

## Sources

- [Delaware Code, Title 6, Chapter 12D (both the current text and the text effective 1 Jan 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

[Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Delaware statute](https://delcode.delaware.gov/title6/c012d/index.html)

Reference material, not legal advice.

## Other topics for Delaware

- [Applicability](https://dposchool.com/state-privacy-laws/state/delaware/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/delaware/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/delaware/sensitive-data)
- [Processors](https://dposchool.com/state-privacy-laws/state/delaware/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/delaware/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Delaware](https://dposchool.com/state-privacy-laws/state/delaware) / Controller duties

Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/delaware/sensitive-data)

Next: [Processors](https://dposchool.com/state-privacy-laws/state/delaware/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents