---
title: "Delaware privacy law (DPDPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/delaware/processors"
source: "https://delcode.delaware.gov/title6/c012d/index.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Delaware Personal Data Privacy Act

# Delaware privacy law (DPDPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Processors must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, subcontractor flow-down after a chance to object, and cooperation with assessments. From 2027 the contract must also state each specific purpose with particularity.

## Key points

1. Processors must follow instructions and assist with consumer requests, security, breach notice and assessments.

   Section: [§ 12D-107(a)](https://delcode.delaware.gov/title6/c012d/index.html)

2. Contract must set out instructions, nature and purpose, data types, duration, and the rights and obligations of both parties.

   Section: [§ 12D-107(b)](https://delcode.delaware.gov/title6/c012d/index.html)

3. Required terms: confidentiality, deletion or return at the end, information to show compliance, subcontractors only after a chance to object and under a written contract, and cooperation with assessments.

   Section: [§ 12D-107(b)(1)-(5)](https://delcode.delaware.gov/title6/c012d/index.html)

4. From 1 Jan 2027 the contract must identify each limited and specific purpose with particularity.

   Section: [§ 12D-107(b)(6) (eff. Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

5. A processor that decides purposes and means becomes a controller for that processing.

   Section: [§ 12D-107(d)](https://delcode.delaware.gov/title6/c012d/index.html)

## Sources

- [Delaware Code, Title 6, Chapter 12D (both the current text and the text effective 1 Jan 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Delaware statute](https://delcode.delaware.gov/title6/c012d/index.html)

Reference material, not legal advice.

## Other topics for Delaware

- [Applicability](https://dposchool.com/state-privacy-laws/state/delaware/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/delaware/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/delaware/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/delaware/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/delaware/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Delaware](https://dposchool.com/state-privacy-laws/state/delaware) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/delaware/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/delaware/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents