Delaware 2027 Compliance
HB 380 and HB 381, signed September 2, 2026 — effective January 1, 2027.
Delaware Governor Meyer signed two bills amending the Delaware Personal Data Privacy Act and the state's breach-notification law. Here's what changed, in plain terms, with citations.
US-DE-PRIV-001 · 6 Del. C. § 12D-103(a)
Who the law applies to
Businesses conducting business in or targeting Delaware residents that controlled/processed 10,000+ consumers' data in the prior year (excluding payment-only processing), or 5,000+ consumers while deriving over 20% of revenue from data sales.
US-DE-PRIV-002 · 6 Del. C. § 12D-102(30)
Expanded sensitive-data categories
Includes categories not present in many other state laws: neural data, citizenship/immigration status, and financial account credentials, alongside the usual health, racial/ethnic origin, religious belief, sexual orientation, and transgender/nonbinary status categories.
US-DE-PRIV-003 · 6 Del. C. § 12D-106(a)(12)
Sale of sensitive data is banned by default
Permitted only when strictly necessary for a consumer-requested product/service, with clear pre-sale notice, documented consent, and a 5-year consent record.
US-DE-PRIV-004 · 6 Del. C. § 12D-104(a)(5)
Third-party disclosure list right
Consumers can request the categories of third parties their data has been disclosed to.
US-DE-PRIV-005 / 006 · 6 Del. C. § 12D-104(a)(6)(c), § 12D-106(f)(1)(d)
Automated-decision opt-out + human review
Consumers may opt out of profiling used for solely-automated decisions with legal or similarly significant effects (employment, housing, credit, insurance, education), and may request human review where technically feasible.
US-DE-PRIV-007 · 6 Del. C. § 12D-108(a)
Data protection assessments
Required for controllers processing 50,000+ consumers' data engaged in high-risk activity (targeted advertising, sale, or risky profiling), on a regular, documented basis.
US-DE-PRIV-009 · 6 Del. C. § 12B-102(c)(3)
60-day Attorney General breach notification
HB 381 requires notifying the Delaware Attorney General within 60 days of determining a breach occurred — for any breach affecting a Delaware resident, regardless of scale. This removed the prior 500-resident threshold.
Sources: official Delaware General Assembly bill text (HB 380, HB 381) and the official Governor's signing announcement.
Not sure if this applies to you?
Run the applicability check first — it's the first question the tool answers, free of the full assessment.