Law / United States / 
Delaware
Computer Security Breaches, protection of personal information
Del. Code Ann. tit. 6, section 12B-100
In force since .
A security baseline statutes rule binding public and private bodies.
- Criminal exposure
- No
- Obligation class
- Security
What it requires
- This binds any person, including a government entity, that conducts business in Delaware and owns, licenses, or maintains personal information of a Delaware resident.
- Implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
- There is no separate compliance runway to build against: the duty has been in force since , when 81 Del. Laws, c. 129, section 1 took effect 240 days after its approval.
- Expect enforcement only from the Delaware Attorney General, through the Director of Consumer Protection, seeking to address a violation and to recover direct economic damages; the chapter does not itself state whether a private plaintiff may also sue.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Del. Code Ann. tit. 6, section 12B-104(a) authorizes the Attorney General, through the enforcement duties and powers of the Director of Consumer Protection of the Department of Justice under Title 29, Chapter 25, to bring an action in law or equity to address a violation of this chapter and to recover direct economic damages resulting from a violation, or both.
What this law does
Any person, including a government entity, who conducts business in Delaware and owns, licenses, or maintains personal information must implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
The duty was added to the Computer Security Breaches chapter by 81 Del. Laws, c. 129, section 1, alongside that chapter's breach-notification amendments; the Act was approved and, by its own Section 2, became effective 240 days later, on .
The Attorney General, through the Director of Consumer Protection of the Department of Justice under Title 29, Chapter 25, may bring an action in law or equity to address a violation of the chapter and to recover direct economic damages resulting from a violation, or both; the chapter states no fixed civil penalty or statutory damages figure for this duty and creates no criminal offense.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .