DPO SchoolDPO School

Delaware Personal Data Privacy Act

Delaware privacy law (DPDPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Department of Justice enforces the Act exclusively, and there is no private right of action. The mandatory 60-day cure period applied only in 2025; since 1 Jan 2026 a cure opportunity is discretionary. A violation is an unlawful practice under the consumer fraud law, which allows civil penalties of up to $10,000 for each wilful violation.

Key points

  1. Enforcement solely by the Department of Justice.

    Section: § 12D-111(a), (e)

  2. 2025 only: notice and 60 days to cure where a cure was possible.

    Section: § 12D-111(b)

  3. From 1 Jan 2026 the Department may grant a cure opportunity, weighing factors such as number of violations, size, nature of processing, risk of injury, human or technical error and prior violations.

    Section: § 12D-111(c)

  4. A violation is an unlawful practice under § 2513 of Title 6.

    Section: § 12D-111(e)

  5. Civil penalty of up to $10,000 per wilful violation under the consumer fraud law.

    Section: Del. Code Ann. tit. 6, § 2522(b)

  6. No private right of action.

    Section: § 12D-111(d)

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Delaware statute

Reference material, not legal advice.