Delaware Personal Data Privacy Act (DPDPA)

Delaware's comprehensive privacy law, effective 1 January 2025. HB 380 (2026), lowering thresholds and adding privacy impact assessments, awaits gubernatorial action.

JurisdictionDelaware
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Delaware Personal Data Privacy Act (DPDPA) establishes several key requirements for businesses:

  • Consumer Rights: The DPDPA grants Delaware residents specific rights over their personal data, including:
  • Right to access personal data
  • Right to correct inaccuracies
  • Right to delete personal data
  • Right to data portability
  • Right to opt-out of data sales, targeted advertising, and profiling

Source: Delaware Department of Justice

  • Privacy Notices: Controllers must provide clear, accessible privacy notices detailing:
  • Categories of personal data processed
  • Purposes of processing
  • Categories of personal data shared with third parties
  • Consumer rights and how to exercise them

Source: Delaware General Assembly

  • Data Protection Assessments: Controllers processing data of 100,000+ consumers must conduct regular data protection assessments for high-risk processing activities.

Source: Usercentrics

  • Consent for Sensitive Data: Controllers must obtain explicit consent before processing sensitive personal data.

Source: Akin Gump

  • Universal Opt-Out Mechanisms: By January 1, 2026, controllers must recognize universal opt-out signals.

Source: Davis Wright Tremaine

Compliance Challenges

Organizations face several challenges in complying with the DPDPA:

  • Low Applicability Threshold: The DPDPA applies to businesses processing data of just 35,000 Delaware residents, lower than other state privacy laws, potentially catching more small businesses.

Source: Osano

  • Data Inventory and Mapping: Companies struggle to identify and categorize all personal data they process, especially across complex systems.

Source: BigID

  • Implementing Consumer Rights: Fulfilling data subject requests within the required 45-day timeframe can be challenging, especially for companies with fragmented data systems.

Source: Termly

  • Consent Management: Obtaining and managing valid consent, particularly for sensitive data processing, requires robust systems and processes.

Source: Secureprivacy.ai

Implementation Best Practices

To effectively implement DPDPA requirements:

  • Conduct a Comprehensive Data Inventory: Map all personal data flows within your organization.

Source: ShardSecure

  • Update Privacy Notices: Ensure your privacy policy clearly communicates all required information.

Source: Termly

  • Implement Consent Management: Use a consent management platform to obtain and record valid consent.

Source: Usercentrics

  • Establish Data Subject Request Processes: Create efficient workflows to handle consumer rights requests.

Source: DataGrail

  • Conduct Regular Data Protection Assessments: Implement a process for ongoing risk assessments of high-risk processing activities.

Source: Securiti.ai

Recent Updates

The DPDPA is a new law with key dates:

  • Signed into Law: September 11, 2023

Source: Jones Day

  • Effective Date: January 1, 2025

Source: Delaware Department of Justice

  • Universal Opt-Out Mechanism Requirement: January 1, 2026

Source: Davis Wright Tremaine

  • Cure Period Expiration: December 31, 2025

Source: Akin Gump

Related Regulations

The DPDPA interacts with several other privacy regulations:

  • California Consumer Privacy Act (CCPA): Similar consumer rights and business obligations.

Source: California Privacy Protection Agency

  • Virginia Consumer Data Protection Act (VCDPA): Comparable requirements for data protection assessments.

Source: Virginia Office of the Attorney General

  • General Data Protection Regulation (GDPR): Shares principles of data minimization and purpose limitation.

Source: European Data Protection Board

Industry Impact

The DPDPA will significantly impact various industries:

  • E-commerce: Online retailers will need to update privacy practices and implement opt-out mechanisms.

Source: National Law Review

  • Financial Services: While GLBA-regulated entities are exempt, many fintech companies may still need to comply.

Source: Davis Wright Tremaine

  • Healthcare: Unlike some state laws, DPDPA does not fully exempt HIPAA-covered entities, requiring careful compliance assessment.

Source: Jones Day

Sources

Recent developments

  • — A practitioner alert explains HB 380 would significantly **expand DPDPA scope** (including direct coverage of vendors/data brokers receiving Delaware data), add new health-data exclusions aligned with HIPAA, and introduce profiling-related obligations and lower data protection assessment thresholds, with changes expected to take effect 2027-01-01.[4] (source)
  • — Delaware’s legislature passed HB 380 on 2026-06-16 to **amend the DPDPA**, lowering applicability thresholds, expanding consumer rights (including more sensitive data categories and a right to know third-party disclosures), and creating new obligations for controllers and third-party data recipients effective 2027-01-01 if signed by the Governor.[6] (source)
  • — HB 380, amending the DPDPA, passed the Delaware State Legislature and was sent to the Governor, notably **reducing the main coverage threshold from 35,000 to 10,000 consumers (and to 5,000 with >20% revenue from data sales)** and formally extending the law to certain third parties.[7] (source)
  • — Delaware House Bill 380 passed the legislature and was sent to the governor, proposing major amendments to the DPDPA. The bill would lower applicability thresholds, expand consumer rights, and add new obligations for controllers and third-party recipients. (source)
  • — A legal analysis of HB 380 says the amendments would take effect on 2027-01-01 if signed, with stricter coverage thresholds and broader definitions of sensitive data. It also highlights new rights around profiling and third-party disclosure lists. (source)
  • — Delaware House Democrats reported passage of bills to strengthen the state’s privacy law and breach transparency requirements. The package would expand sensitive data categories, restrict processing of minors’ data, and require notice to the Attorney General after certain breaches. (source)
  • — Industry commentary on HB 380 highlights that Delaware is moving to **tighten and broaden DPDPA applicability**, projecting lower thresholds, expanded assessments, and increased compliance pressure on mid-size businesses, and urging companies to update inventories and consent mechanisms in anticipation of the amendments.[8] (source)
  • — DataGuidance’s Delaware jurisdiction page notes the state’s DPDPA became effective on 2025-01-01 and tracks continuing developments. The page is useful as a consolidated source for recent legislative and enforcement-related updates. (source)
  • — A regulatory overview notes the **DPDPA took effect on 2025-01-01**, details key obligations (data minimization, security measures, opt-in for sensitive data, data protection assessments starting at 100,000 consumers), and flags the 2026-01-01 requirement to recognize Global Privacy Controls and universal opt-out mechanisms, driving technical and UX changes across covered organizations.[1] (source)
  • — Legal analysis ahead of effectiveness outlines core DPDPA features—consumer rights (access, correction, deletion, opt-out of sales/targeted ads/profiling), controller–processor contract requirements, and DOJ-only enforcement with a cure period until end of 2025—prompting companies to enhance privacy notices, contract terms, and opt-out flows before 2025.[3] (source)
  • — A law firm client update describes Delaware as the **13th state with a comprehensive privacy law**, explains the 2025-01-01 effective date, applicability thresholds, and enforcement model, and advises organizations to align DPDPA programs with other state laws while accounting for Delaware’s relatively low thresholds and broad consumer rights.[5] (source)
  • — Privacy-tech commentary emphasizes that because of Delaware’s low thresholds and broad controller duties, **smaller and mid-market businesses** are being pulled into comprehensive privacy compliance, increasing demand for consent management, DSAR handling tools, and data mapping tailored to DPDPA nuances.[1] (source)

Read the full guide to Delaware Personal Data Privacy Act (DPDPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates