Processes de-identified data, in Delaware

Del. Code Ann. tit. 6, §§ 12D-102(14), 12D-109 · Read the law's page

• To treat data as de-identified under the DPDPA, take reasonable measures to ensure that it cannot be associated with an individual (section 12D-102, definition of de-identified data).
• Publicly commit to process the data only in a de-identified fashion and not to attempt to re-identify it (section 12D-102, definition of de-identified data).
• Contractually obligate every recipient of the data to comply with all of the provisions of the chapter that apply to a controller with respect to the data (section 12D-102, definition of de-identified data).
• When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (section 12D-109(d)). From January 1, 2027, that oversight must include entering contractual commitments to ensure the proper and limited use of the data.