Delaware Updates Consumer Privacy and Data-Breach Laws

• •Delaware's DPDPA now applies to businesses with as few as 10,000 consumers.
• •New consumer rights include access to actual third-party data recipients.
• •Breach notification law now requires notification to the Delaware Attorney General.

On September 2, 2026, Delaware's Governor signed House Bill (HB) 380 and HB 381, amending the Delaware Personal Data Privacy Act (DPDPA) and the state's computer security breach notification law. HB 380 lowers the applicability threshold for businesses from 35,000 to 10,000 consumers, expanding the law's reach. It also introduces new consumer rights, allowing individuals to obtain lists of actual third parties that have received their personal information. HB 381 updates breach notification requirements, mandating that organizations notify the Delaware Attorney General within 60 days of determining a breach. The amendments take effect on January 1, 2027, for HB 380, while HB 381 is effective immediately. These changes aim to enhance consumer protections and data management practices across various sectors.