Processes personal data, in Delaware

Del. Code Ann. tit. 16, §§ 717, 718 · Read the law's page

• Do not disclose, and do not comply with a compulsion to disclose, the identity of any person upon whom an HIV-related test (an HIV test, CD4 cell count test, viral load test or any other test related to HIV) is performed, or the results of the test in a manner that permits identification of the subject of the test, except to a person section 717(a) lists, for example the subject or the subject's legal guardian, a person holding a legally effective release the subject executed, or a person a court order allows to have access.
• If you received the results of an HIV-related test under section 717(a), do not disclose them to another person except as section 717(a) authorizes.

Del. Code Ann. tit. 6, §§ 1202C, 1203C, 1205C · Read the law's page

• Make a privacy policy conspicuously available if your commercial website, online or cloud computing service, online application or mobile application collects personally identifiable information through the Internet (a first and last name, a physical address, an e-mail address, a telephone number, a Social Security number or any other identifier that permits physical or online contacting of the user) about users who reside in Delaware: post it on the homepage or first significant page, or link to it there with an icon or a text link that contains the word "privacy" or with another functional hyperlink a reasonable individual would notice; for a service that is not a website, any other reasonably accessible and visible means works.
• Identify in the policy the categories of personally identifiable information you collect through the service about its users and the categories of third-party persons with whom you may share it.
• If you maintain a process for a user to review and request changes to the user's personally identifiable information collected through the service, describe that process in the policy.
• Describe in the policy how you notify users of material changes to it, and identify its effective date.
• If you collect personally identifiable information about a user's online activities over time and across third-party websites, services or applications, disclose in the policy how you respond to web browser "do not track" signals or other mechanisms that let users choose; a clear and conspicuous hyperlink in the policy to a description, including the effects, of any program or protocol you follow that offers that choice satisfies this.
• Disclose in the policy whether other parties may collect personally identifiable information about a user's online activities over time and across different websites, services or applications when the user uses your service.
• Follow the section and your own posted privacy policy: a failure to comply is a violation when it is knowing and wilful, or negligent and material.
• Make a missing policy conspicuously available within 30 days after you are notified that it is missing.
• You are not an operator under the chapter if you only operate, host or manage a website, service or application on its owner's behalf, or process information on the owner's behalf, without owning it.

Del. Code Ann. tit. 6, section 12B-100 · Read the law's page

• Implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
• This binds any person, including a government entity, that conducts business in Delaware and owns, licenses, or maintains personal information of a Delaware resident.
• There is no separate compliance runway to build against: the duty has been in force since April 14, 2018, when 81 Del. Laws, c. 129, section 1 took effect 240 days after its August 17, 2017 approval.
• Expect enforcement only from the Delaware Attorney General, through the Director of Consumer Protection, seeking to address a violation and to recover direct economic damages; the chapter does not itself state whether a private plaintiff may also sue.

Del. Code Ann. tit. 6, § 12D-104 · Read the law's page

• Give a Delaware consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Delaware consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor universal opt-out preference signals as of January 1, 2026. Until December 31, 2026 the profiling opt-out reaches only solely-automated decisions; from January 1, 2027 it reaches automated decisions.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.
• From January 1, 2027, include in your response to an access request any inferences about the consumer derived from their personal data, and whether you or a processor is processing it for profiling to make a decision that produces a legal or similarly significant effect concerning the consumer (section 12D-104(a)(1)).
• From January 1, 2027, on request give a consumer a list of the third parties, not only the categories of third parties, to which you have disclosed their personal data, unless the data is pseudonymous, you cannot compile the list with reasonable effort (in which case disclose all third parties to which you disclose personal data) or listing a third party would reveal a trade secret (section 12D-104(a)(5)).
• From January 1, 2027, do not disclose in response to an access request the consumer's Social Security number, driver's license, state identification card or other government-issued identification number, financial account number, health insurance or medical identification number, account password, security question or answer, or biometric data; tell the consumer, with sufficient particularity, that you process them (section 12D-104(c)(6)).

Del. Code Ann. tit. 6, § 12D-111 · Read the law's page

• Expect DPDPA violations to be enforced solely by the Delaware Department of Justice, never by a private plaintiff.
• Do not assume a mandatory cure notice as of right. The mandatory cure period ended December 31, 2025; since January 1, 2026 the Department of Justice decides whether to offer one.

Del. Code Ann. tit. 6, §§ 12D-101, 12D-103, 12D-106 to 12D-108 · Read the law's page

• Cite DPDPA to Title 6, Chapter 12D of the Delaware Code, not Chapter 12C, which is a different statute.
• From January 1, 2027, comply with DPDPA if you control or process the personal data of 10,000 or more Delaware consumers, or of 5,000 or more where more than 20% of your gross revenue comes from selling personal data, or if you are a third party that acquires personal data from a controller. From that date, do not treat biometric data that can be associated with a specific consumer and was collected without the consumer's consent as publicly available information, and do not treat personal data processed in connection with profiling and reports under section 12D-106(f) as exempt because it concerns an applicant, employee, agent, or contractor.
• From January 1, 2027, do not rely on being a financial institution subject to Title V of the Gramm Leach Bliley Act as an entity-level exclusion: section 12D-103(b) instead excludes an insurer, insurance producer or other listed insurance entity, a federal or state-chartered bank, credit union or savings association, and an agent, broker-dealer or investment adviser regulated by the Delaware Investor Protection Unit or the Securities and Exchange Commission, with an affiliate or subsidiary of an insurer or bank excluded only if principally engaged in financial activities as described in section 1843(k) of title 12 of the United States Code; data subject to Title V of the Gramm Leach Bliley Act stays excluded under section 12D-103(c)(14).
• From January 1, 2027, limit your processing of personal data to what is reasonably necessary and proportional to the purposes you disclosed to the consumer, and do not process it for an additional purpose that is not reasonably necessary and proportionate to those purposes unless the consumer consents (section 12D-106(a)(1) and (2)).
• From January 1, 2027, before you disclose personal data to a third party, including in a sale or for targeted advertising, enter into a binding contract that limits the disclosure to specified purposes, obliges the third party to comply with the Act and provide the same level of privacy protection, lets you take reasonable steps to ensure the third party uses the data consistently with your obligations and to stop and remediate unauthorized use, and requires the third party to tell you if it can no longer meet its obligations (section 12D-106(a)(10)).
• From January 1, 2027, conduct reasonable due diligence of each third party to which you disclose personal data, at a minimum by assessing it through questionnaires and review of its relevant documents, with further measures commensurate with the sensitivity of the data (section 12D-106(a)(11)).
• From January 1, 2027, if you control or process the data of not less than 50,000 consumers, conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm, including targeted advertising, sale, certain profiling and the processing of sensitive data, and conduct and document an impact assessment if you engage in profiling in furtherance of automated decisions that produce legal or similarly significant effects, covering the purpose and benefits of the profiling, any known or foreseeable heightened risk of harm and its mitigation, the categories of personal data used as inputs and the outputs produced, performance metrics and known limitations, transparency measures, and post-deployment monitoring (section 12D-108(a)).
• From January 1, 2027, if you disclose to a third party a report for use in a decision that produces legal or similarly significant effects concerning a Delaware resident, contract with the third party to give the resident notice of any adverse action based on the report, a description of the personal data relied on, and a statement that the resident may request human review where technically feasible; on a resident's request, provide within 30 days the personal data you maintain, the source of the personal data used in profiling and the third parties that obtained a report within the previous 24 months; and give the resident an opportunity to correct incorrect personal data (section 12D-106(f)).
• From January 1, 2027, if you are a processor, your contract with the controller must identify each limited and specific purpose for which you process personal data, described with specificity and particularity and not generically, and you must provide the information and cooperate with the reasonable assessments the controller or its designated assessor needs to conduct due diligence (section 12D-107(a)(4), (b)(3) and (b)(6)).
• From January 1, 2027, if you are a third party that receives personal data from a controller or processor without a contract the chapter requires, do not further process it, comply with the terms of any contract the chapter requires, provide the information the controller needs for its data protection assessments and due diligence, and, if you meet section 12D-103(a)(1) or (2), comply with all provisions of the chapter (section 12D-107A).

Del. Code Ann. tit. 6, §§ 12D-102(14), 12D-109 · Read the law's page

• To treat data as de-identified under the DPDPA, take reasonable measures to ensure that it cannot be associated with an individual (section 12D-102, definition of de-identified data).
• Publicly commit to process the data only in a de-identified fashion and not to attempt to re-identify it (section 12D-102, definition of de-identified data).
• Contractually obligate every recipient of the data to comply with all of the provisions of the chapter that apply to a controller with respect to the data (section 12D-102, definition of de-identified data).
• When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (section 12D-109(d)). From January 1, 2027, that oversight must include entering contractual commitments to ensure the proper and limited use of the data.

Del. Code Ann. tit. 16, §§ 1201 to 1208 · Read the law's page

• Do not obtain genetic information about an individual without first obtaining the individual's informed consent, a signed consent form that describes the genetic test or tests to be performed, its purposes, potential uses and limitations and the meaning of its results, and says the individual will receive the results unless the individual directs otherwise. Section 1202(b) lifts the bar for the purposes it lists, such as a law-enforcement identification in a criminal investigation, paternity, newborn screening and anonymous research.
• Do not retain an individual's genetic information without first obtaining informed consent (a signed consent form describing the information to be retained, its potential uses and limitations), unless one of the exceptions in section 1203(a) applies. Destroy the sample from which genetic information was obtained promptly, unless section 1203(b) allows retention, including retention the individual authorizes.
• On an individual's request, promptly let the individual inspect, request correction of and obtain the genetic information in that individual's records.
• Do not disclose, and do not comply with a subpoena or other compulsion to disclose, the identity of an individual on whom a genetic test has been performed or genetic information about the individual in a manner that permits identification, unless section 1205(a) allows it, for example with the tested individual's informed consent describing the information to be disclosed and to whom. The bar also reaches a later discloser who received the information from another person.

Del. Code Ann. tit. 18, § 2317 · Read the law's page

• If you issue, deny, renew or price health insurance in Delaware (health insurance as section 3602 of title 18 defines it, not disability or long-term care insurance), do not discriminate against any individual in the issuance, denial or renewal of, or in the fixing of the rates, terms or conditions for, the insurance based on any genetic characteristic or genetic information.

Del. Code Ann. tit. 18, § 2317A · Read the law's page

• If you are in the business of life insurance, do not, based solely on a genetic characteristic or genetic information contained in the result of a genetic test, deny, refuse to issue, refuse to renew or reissue, cancel or otherwise terminate a policy or restrict coverage, add a surcharge or rating factor to a premium, or otherwise discriminate in offering, issuing, cancelling, the amount of coverage, price, payment of claims or any other condition of a policy without additional actuarial justification. Section 2317A(c) lifts this for a genetic characteristic, genetic information or test result that is in the individual's medical record or pertinent family history.
• Do not require or request that an individual or a member of the individual's family take a genetic test, and do not take into consideration the individual's refusal to take one.
• Do not require or request that an individual provide genetic information received from an entity providing direct-to-consumer genetic testing, or written consent for such an entity to share information about the individual, and do not take into consideration a refusal to provide either.
• Do not attempt to obtain, or obtain, information from an entity providing direct-to-consumer genetic testing without the individual's written informed consent as required under section 1202 of title 16.

Del. Code Ann. tit. 6, §§ 12B-101 to 12B-104 · Read the law's page

• Notify affected Delaware residents of a breach of security without unreasonable delay and no later than 60 days after determining the breach occurred.
• Notify the Delaware Attorney General, by the time you notify residents, if the breach affects more than 500 Delaware residents.
• If reasonable diligence did not let you identify within 60 days that certain residents' personal information was in the breach, notify those residents as soon as practicable after determining that it was, and notify the Delaware Attorney General of the breach within 60 days after determining the breach occurred, unless you have provided substitute notice within that period (section 12B-102(c)(3)).