Law / United States / 
Delaware
Computer Security Breaches
Del. Code Ann. tit. 6, §§ 12B-101 to 12B-104
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Notify affected Delaware residents of a breach of security without unreasonable delay and no later than 60 days after determining the breach occurred.
- Notify the Delaware Attorney General, by the time you notify residents, if the breach affects more than 500 Delaware residents.
- If reasonable diligence did not let you identify within 60 days that certain residents' personal information was in the breach, notify those residents as soon as practicable after determining that it was, and notify the Delaware Attorney General of the breach within 60 days after determining the breach occurred, unless you have provided substitute notice within that period (section 12B-102(c)(3)).
These lines are LexLint's reading of the law's text. Also read by: Delaware Department of Justice, Consumer Protection Unit (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Consumer Protection Unit's page counts the 60 days from the discovery of the security breach, where the statute counts them from the determination of the breach of security.
- As of
- Guidance link
- https://attorneygeneral.delaware.gov/fraud/cpu/securitybreachnotification/
- Guidance body
- Delaware Department of Justice, Consumer Protection Unit
- Open questions
- Does the 60-day period in Section 12B-102(c) run from the 'determination of the breach of security', the point at which a person has sufficient evidence to conclude that a breach has taken place, or from the discovery of the breach?
What it makes you log
Logging duty
Section 12B-102 requires notice of a breach of security to affected Delaware residents (within 60 days) and to the Attorney General where more than 500 residents are affected, and a person that maintains data it does not own must notify the owner. A duty to notify is a report and sets no record to be kept. Section 12B-103 deems a person compliant that follows its own written notice procedures or its regulator's procedures, which are policies and are not coded as a record. Section 12B-100's duty to maintain reasonable procedures and practices names no log.
- Kind
- None
- As of
What this law does
Notice of a breach of security must be made without unreasonable delay and no later than 60 days after determination of the breach, except in specified situations. If the number of affected Delaware residents exceeds 500, the person required to provide notice must also notify the Attorney General by the time notice is provided to residents. House Bill 381 (153rd General Assembly) was signed on .
It is Chapter 464 of Volume 85 of the Laws of Delaware and took effect on . Substitute notice now includes notice of the breach of security to the Attorney General. Where a person could not identify within 60 days that a resident's personal information was in the breach, the person must also notify the Attorney General within 60 days after the determination of the breach, unless the person has provided substitute notice within that period.
A person regulated by state or federal law, including under Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act, that maintains its regulator's breach procedures is now deemed to comply with section 12B-102(c) if it notifies affected residents under those procedures. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .