On September 2, 2026, Delaware’s Governor signed House Bill (HB) 380 and HB 381. HB 380 amends the Delaware Personal Data Privacy Act (DPDPA), which was enacted in 2023 and became effective January 1, 2025. HB 381 separately amends Delaware’s computer security breach notification law.

In short, what changes were made to the Delaware privacy and data-breach laws?

Together, the bills expand the businesses and data covered by existing law, increase protections for sensitive data, impose new vendor-management and automated decision-making requirements, and strengthen breach-notification obligations.

When do the changes take effect?

The HB 380 amendments to the DPDPA take effect January 1, 2027, while the HB 381 amendments to the breach-notification law take effect upon signing.

Which organizations does the amended DPDPA cover?

HB 380 lowers the DPDPA’s applicability thresholds. The law previously covered businesses that control or process the personal data of at least 35,000 consumers during the preceding calendar year. That threshold is now reduced to 10,000 consumers. For businesses that derive more than 20% of their gross revenue from selling personal data, the alternative threshold drops from 10,000 to 5,000 consumers.

The amendments also cause the DPDPA to apply to third parties that acquire personal data from a controller. Recall that third parties are defined broadly to include, with respect to personal data controlled by a controller, any person other than the relevant consumer, the controller of such personal data, or a processor or an affiliate of the processor or the controller.

Accordingly, organizations that fell below the original thresholds and potential third parties should reassess whether they are now subject to the DPDPA under the lower thresholds and changes enacted by HB 380. However, the changes also clarified organizations and categories of data that are excluded from the DPDPA, largely affecting financial institutions and the healthcare sector.

How did consumer rights change?

Consumer rights under the DPDPA have expanded in some significant ways. Consumers can now confirm whether controllers are including inferences about the consumer derived from personal data and processing personal data for profiling purposes to make significant decisions about the consumer.

Additionally, under the prior law, consumers had the right to obtain a list of “categories of third parties to which the controller has disclosed” their personal information. Under HB 380, consumers can obtain the list of the actual third parties, subject to several exceptions, including if the list would reveal a trade secret or that list cannot be compiled with reasonable effort. However, in that case, the controller must disclose all third parties to which it disclosed personal information.

The amendment also limits the consumer right of access with respect to certain sensitive data elements. For example, controllers may not disclose a consumer’s SSN or account password, but may only inform the consumer that the controller possesses that information.

Did the contents of the controller privacy notice change?

Yes, privacy notices must identify the controller for contact purposes, and include a description of the consumer’s personal data rights.

What new categories of sensitive data does HB 380 add?

HB 380 expands the definition of sensitive data to include national origin; health treatment or status; neural data; certain financial-account information and credentials; and government-issued identification numbers. It also covers inferences drawn from other information when those inferences are used to reveal or identify a sensitive characteristic.

What are the new requirements for processing sensitive data under Delaware law?

Processing sensitive data requires the consumer’s consent and must be reasonably necessary and proportionate to the disclosed purpose.

Are there restrictions on selling sensitive data?

Yes. A controller may sell sensitive data only when the disclosure is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer. The controller must provide a clear and conspicuous notice, obtain the consumer’s consent, and retain a record of that consent for five years.

What new vendor-management obligations does HB 380 impose?

Controllers must enter into contracts with third parties receiving personal data. Those contracts must identify limited and specific purposes for the data, require the third party to provide the same level of privacy protection as the controller, and permit the controller to address unauthorized uses. Controllers must also conduct reasonable due diligence regarding third parties, including, at minimum, questionnaires and reviews of relevant documents.

What does HB 380 require for automated profiling and decision-making?

HB 380 adds requirements for profiling and reports used in decisions that produce legal or similarly significant effects, such as decisions about employment, housing, lending, insurance, education, or healthcare. When a report contributes to an adverse action, contractual provisions must require notice to the affected Delaware resident, identification of the data relied upon, and information about requesting human review where technically feasible.

Are impact assessments required for automated profiling?

Yes. Controllers engaging in covered automated profiling must conduct and document impact assessments. These assessments must address risks, inputs, outputs, performance measures, limitations, transparency, and post-deployment safeguards.

Does the employee-data exclusion still apply?

The existing employee-data exclusion is narrowed for personal data used in the context of profiling or disclosing to a third party a report for use in connection with any decision that produces legal or similarly significant effects on a resident of Delaware. In such cases, controllers and third parties have several requirements, including notice requirements to the residents concerning adverse actions, contract obligations, and additional consumer rights requests relating to personal information use in profiling.

What changes does HB 381 make to Delaware’s breach-notification law?

Like many states, the Delaware breach notification law provides an alternative way to provide notice (called “substitute notice”) when the cost of notification will exceed $75,000, the number of affected Delaware residents exceeds 100,000, or the organization does not have sufficient contact information to provide notice. Substitute notice typically involves email notice, conspicuous website notice, and notice to major statewide media. HB 381 updated the substitute notice requirement to also include notice to the Delaware Attorney General.

Additionally, in situations when an organization, through reasonable diligence, cannot identify within 60 days that personal information of Delaware residents was involved in a breach, it must provide required notification as soon as practicable after it determines such information was involved. HB 381 adds that notice to the Attorney General also must be provided within 60 days of that determination.

Does compliance with HIPAA or the Gramm-Leach-Bliley Act satisfy Delaware’s breach-notification requirements?

HB 381 narrows the existing exemption for entities regulated under laws such as HIPAA or the Gramm-Leach-Bliley Act. In short, compliance with regulator-established breach procedures now satisfies only Delaware’s 60-day timing requirement, rather than the entire state breach-notification law.

Who enforces the amended DPDPA?

The DPDPA amendments retain enforcement by the Delaware Department of Justice. The amendments do not create a private right of action.

What steps should businesses take to prepare for the new requirements?

Businesses should reassess whether they are covered under the lower applicability thresholds, inventory sensitive data and automated decision-making activities, update incident-response procedures, and review privacy notices, consent processes, third-party contracts, and vendor due diligence practices.