Delaware raises the bar: Significant amendments to its Personal Data Privacy Act

On September 2, 2026, Delaware Governor Matt Meyer signed two bills to substantially expand the state’s existing data privacy framework. House Bill 380, which takes effect on January 1, 2027, amends the 2023 Delaware Personal Data Privacy Act (DPDPA). House Bill 381 amends Delaware’s data breach notification law and took effect upon signing.

Delaware is among approximately 20 states that have enacted comprehensive data privacy laws. According to Governor Meyer, the newly enacted legislation “creates the broadest data protection in the country,” as the bills set the lowest applicability threshold in the nation and provide enhanced protections for consumers.

We summarize the many highlights of each of these new laws below.

Applicability and scope (HB 380)

• Lowered applicability thresholds. HB 380 substantially lowers the applicability thresholds for businesses that process and control data. The DPDPA will now apply to entities that conduct business in Delaware or produce products or services targeted at Delaware residents if they:
  • Control or process the personal data of at least 10,000 consumers (lowered from 35,000); or
  • Control or process the personal data of at least 5,000 consumers (lowered from 10,000) and derive more than 20% of their gross revenue from selling personal data.
• Expanded “sensitive data” categories. The amendment also expands the definition of “sensitive data” to include inferences companies make from personal data that reveal or identify any of the following additional categories:
  • Data that reveals or identifies national origin, citizenship status, immigration status, diagnosis or treatment status, or gender identity;
  • Neural data generated by measuring the activity of an individual’s central nervous system;
  • Financial account number, login information, or credit or debit card number that (alone or in combination with a security code, password, or credential) would allow access to a consumer’s financial account; and
  • Government-issued identification number, including Social Security number, passport number, state identification number, or driver’s license number.
• Broadened profiling opt-out rights. The bill expands the right to opt out when companies use personal data in automating legally significant decision-making processes, such as in evaluating loan or housing applications or hiring employees.
• Revised GLBA exemptions. The bill narrows the Gramm-Leach-Bliley Act (GLBA) applicability exemptions by exempting all GLBA-regulated data. Entity-level exemptions are now limited to banks, insurers, and securities firms.
• Updated health data exemptions. HB 380 expands on data-level exclusions for healthcare information, including health information maintained by medical device manufacturers when processed under HIPAA, information subject to the Federal Health Care Quality Improvement Act of 1986, de-identified data derived from HIPAA-PHI or research data, and certain limited data sets under HIPAA.
• Third-party data sale requirements. The bill introduces contracting and due diligence requirements where organizations sell or disclose personal data to third parties. Before selling or disclosing sensitive data, controllers must provide consumers with clear and conspicuous notice stating the specific categories of sensitive data disclosed, the purpose of the disclosure, and the identities of the third-party recipients.

Breach notification updates (HB 381)

HB 381 strengthens Delaware’s data breach notification requirements. Under the new law, businesses that experience a data breach must notify the Delaware Department of Justice within 60 days of determining that a breach occurred, regardless of whether the company has confirmed Delaware consumers are affected.

Implications for businesses

In light of these legislative developments, companies operating or doing business in Delaware should consider the following steps:

• Evaluate expanded applicability. Given the substantially lowered thresholds, businesses that were previously outside the DPDPA’s scope should reassess whether they are now subject to its requirements.
• Review data sharing practices. Organizations that sell or disclose personal data to third parties must ensure they meet the new contracting and due diligence obligations.
• Update breach notification procedures. Companies should review their incident response protocols to comply with HB 381’s 60-day notification requirement to the Delaware DOJ.
• Assess sensitive data handling. Businesses should review how they handle the expanded categories of sensitive data and ensure that consumer consent is obtained where required.
• Review automated decision-making systems. Companies that use profiling or automated systems to make decisions with legally significant effects on consumers should implement processes to recognize and honor consumer opt-outs.

We will continue to monitor developments as Delaware’s updated data privacy framework takes effect. If you have any questions about your company’s compliance with cyber regulations, concerns about vulnerability to cyber-attacks or other incidents, or if you would like to learn more about proactive cybersecurity defense, please contact Blair Dawson, Allison Cronin, or any member of McDonald Hopkins’ national data privacy and cybersecurity team.