DPO SchoolDPO School

Delaware Personal Data Privacy Act

Delaware privacy law (DPDPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, subcontractor flow-down after a chance to object, and cooperation with assessments. From 2027 the contract must also state each specific purpose with particularity.

Key points

  1. Processors must follow instructions and assist with consumer requests, security, breach notice and assessments.

    Section: § 12D-107(a)

  2. Contract must set out instructions, nature and purpose, data types, duration, and the rights and obligations of both parties.

    Section: § 12D-107(b)

  3. Required terms: confidentiality, deletion or return at the end, information to show compliance, subcontractors only after a chance to object and under a written contract, and cooperation with assessments.

    Section: § 12D-107(b)(1)-(5)

  4. From 1 Jan 2027 the contract must identify each limited and specific purpose with particularity.

    Section: § 12D-107(b)(6) (eff. Jan. 1, 2027)

  5. A processor that decides purposes and means becomes a controller for that processing.

    Section: § 12D-107(d)

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Delaware statute

Reference material, not legal advice.