The Delaware Personal Data Privacy Act (DPDPA) took effect on January 1, 2025, but new changes are on the horizon starting January 1, 2027. Under the current law, the DPDPA generally applies to entities that:
Delaware expanded its data privacy framework when Governor Matt Meyer signed House Bill 380 into law on September 2, 2026, with the amendments taking effect on January 1, 2027.
Employers should be aware that the amendments represent a major shift in applicability thresholds, potentially applying to organizations that were previously exempt.
The threshold for organizations conducting business in Delaware or producing products and services targeted at Delaware residents will be changing from 35,000 consumers to 10,000. For businesses that derive over 20% of their total gross revenue from selling personal data, that number drops from 10,000 down to 5,000. Data protection assessment requirements also now apply to organizations processing data from 50,000 or more consumers, down from 100,000.
The amendment expands the law's applicability to third parties that acquire personal data from a controller without specifying a numerical threshold.
Covered businesses will face new contracting and due-diligence requirements when disclosing or selling personal data to third parties under § 12D-106(a)(10)–(11).
The law also establishes direct obligations for third parties that receive personal data under § 12D-107A.
Delaware House Bill 380 broadens sensitive-data categories to include:
The law also expressly includes an individual's status as transgender or nonbinary and any related medical treatments.
Under the original DPDPA, consumers had the right to opt out of profiling used in solely automated decisions that could significantly affect them.
Under House Bill 380, consumers’ rights to opt out of having their personal data used for profiling are expanded to include automated decisions that could significantly affect them, rather than solely automated decisions. In other words, consumers will now be able to opt out of certain profiling even when people are involved in the decision-making process. These decisions include, but are not limited to, decisions involving:
Under § 12D-103(b), House Bill 380 narrows existing exemptions for financial institutions, replacing broader exemptions with more specific exemptions for certain banks, credit unions, insurance entities, and investment professionals.
HB 380 limits existing exemptions for certain employment-related personal data. While certain applicant-related information was previously exempt from the law, some data used in profiling and reporting activities may now be subject to additional requirements under § 12D-106(f).
The amendment also creates an exception to certain reporting requirements under § 12D-106(f) for qualifying FCRA-compliant consumer reports and outputs. This exception is outlined in § 12D-106(g), Duties of Controllers.
HB 380, § 12D-103(c)(15)–(18), adds four categories of exempt health care information, including certain data related to health care operations, quality improvement, de-identified health information, and limited data sets regulated under federal law.
For the full details on Delaware’s House Bill 380, take a closer look at the law here.
This content is for informational purposes only and shall not constitute legal opinion or advice. Consult your legal counsel to ensure compliance.