Law / United States / 
Delaware
Delaware Personal Data Privacy Act (DPDPA), general applicability and controller/processor duties
Del. Code Ann. tit. 6, §§ 12D-101, 12D-104 to 12D-109
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Cite DPDPA to Title 6, Chapter 12D of the Delaware Code, not Chapter 12C, which is a different statute.
- From , comply with DPDPA if you control or process the personal data of 10,000 or more Delaware consumers, or of 5,000 or more where more than 20% of your gross revenue comes from selling personal data, or if you are a third party that acquires personal data from a controller. From that date, do not treat biometric data that can be associated with a specific consumer and was collected without the consumer's consent as publicly available information, and do not treat personal data processed in connection with profiling and reports under section 12D-106(f) as exempt because it concerns an applicant, employee, agent, or contractor.
- From , do not rely on being a financial institution subject to Title V of the Gramm Leach Bliley Act as an entity-level exclusion: section 12D-103(b) instead excludes an insurer, insurance producer or other listed insurance entity, a federal or state-chartered bank, credit union or savings association, and an agent, broker-dealer or investment adviser regulated by the Delaware Investor Protection Unit or the Securities and Exchange Commission, with an affiliate or subsidiary of an insurer or bank excluded only if principally engaged in financial activities as described in section 1843(k) of title 12 of the United States Code; data subject to Title V of the Gramm Leach Bliley Act stays excluded under section 12D-103(c)(14).
- From , limit your processing of personal data to what is reasonably necessary and proportional to the purposes you disclosed to the consumer, and do not process it for an additional purpose that is not reasonably necessary and proportionate to those purposes unless the consumer consents (section 12D-106(a)(1) and (2)).
- From , before you disclose personal data to a third party, including in a sale or for targeted advertising, enter into a binding contract that limits the disclosure to specified purposes, obliges the third party to comply with the Act and provide the same level of privacy protection, lets you take reasonable steps to ensure the third party uses the data consistently with your obligations and to stop and remediate unauthorized use, and requires the third party to tell you if it can no longer meet its obligations (section 12D-106(a)(10)).
- From , conduct reasonable due diligence of each third party to which you disclose personal data, at a minimum by assessing it through questionnaires and review of its relevant documents, with further measures commensurate with the sensitivity of the data (section 12D-106(a)(11)).
- From , if you control or process the data of not less than 50,000 consumers, conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm, including targeted advertising, sale, certain profiling and the processing of sensitive data, and conduct and document an impact assessment if you engage in profiling in furtherance of automated decisions that produce legal or similarly significant effects, covering the purpose and benefits of the profiling, any known or foreseeable heightened risk of harm and its mitigation, the categories of personal data used as inputs and the outputs produced, performance metrics and known limitations, transparency measures, and post-deployment monitoring (section 12D-108(a)).
- From , if you disclose to a third party a report for use in a decision that produces legal or similarly significant effects concerning a Delaware resident, contract with the third party to give the resident notice of any adverse action based on the report, a description of the personal data relied on, and a statement that the resident may request human review where technically feasible; on a resident's request, provide within 30 days the personal data you maintain, the source of the personal data used in profiling and the third parties that obtained a report within the previous 24 months; and give the resident an opportunity to correct incorrect personal data (section 12D-106(f)).
- From , if you are a processor, your contract with the controller must identify each limited and specific purpose for which you process personal data, described with specificity and particularity and not generically, and you must provide the information and cooperate with the reasonable assessments the controller or its designated assessor needs to conduct due diligence (section 12D-107(a)(4), (b)(3) and (b)(6)).
- From , if you are a third party that receives personal data from a controller or processor without a contract the chapter requires, do not further process it, comply with the terms of any contract the chapter requires, provide the information the controller needs for its data protection assessments and due diligence, and, if you meet section 12D-103(a)(1) or (2), comply with all provisions of the chapter (section 12D-107A).
These lines are LexLint's reading of the law's text. Also read by: Delaware Department of Justice, Fraud and Consumer Protection Division (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://attorneygeneral.delaware.gov/fraud/personal-data-privacy-portal/frequently-asked-questions/
- Guidance body
- Delaware Department of Justice, Fraud and Consumer Protection Division
- Open questions
- Does Section 12D-103(a)(3), effective , reach every third party that acquires personal data from a controller, or only a third party that also meets the consumer thresholds in Section 12D-103(a)(1) and (2)?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis, Consent or opt-out state
Log retention
Five years is the period for the record of a consumer's consent to the sale of sensitive data, in force from ; the statute sets no period for the data protection assessments themselves.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A controller of the data of 100,000 or more consumers (50,000 or more from ) must conduct and document, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm (targeted advertising, sale, profiling with a foreseeable risk of injury, sensitive data), and from an impact assessment where it profiles in furtherance of automated decisions with legal or similarly significant effects. From the same date a controller that sells sensitive data must keep a record of the consumer's consent for 5 years and provide it with any assessment produced to the Attorney General. The Attorney General may require a controller to disclose an assessment relevant to an investigation, which is the only access the cited sections give. Sections 12D-106 and 12D-108 set no interval for the assessments and name no list of fields beyond the weighing of benefits against risks and the consent state. The processor contract terms in section 12D-107(b) (information to demonstrate compliance, assessments by the controller or an independent assessor, a report on request) run between the parties and name no regulator access. Applicability under section 12D-103(a) turns on conducting business in Delaware or targeting its residents, with a threshold of 35,000 consumers (10,000 where more than 20% of gross revenue comes from selling personal data) until .
- Kind
- Explicit
- As of
- Provision
- 6 Del. C. § 12D-108(a), (c); § 12D-106(a)(12)d. and e.
- Trigger
- personal_data_processing
- consent_or_optout
- automated_decisions
What this law does
DPDPA governs private-sector processing of Delaware consumers' personal data. It is codified at Del. Code Ann. tit. 6, ch. 12D; Chapter 12C, sometimes cited for the DPDPA, is a different Delaware statute. Enacted as H.B. 154, 152nd General Assembly, effective . Controller duties are allocated at sections 12D-104 through 12D-108 and processor duties at section 12D-109.
House Bill 380 (153rd General Assembly) was signed by the Governor on as Chapter 463 of Volume 85 of the Laws of Delaware, and its amendments take effect on . They lower the applicability thresholds from 35,000 consumers to 10,000 consumers, and from 10,000 consumers to 5,000 consumers where more than 20% of gross revenue comes from the sale of personal data, and extend the Act to third parties who acquire personal data from a controller.
They also remove the employment-context exclusion for personal data processed in connection with profiling and reports under section 12D-106(f). In the definition of publicly available information, the widely-distributed-media limb no longer reaches biometric data that can be associated with a specific consumer and was collected without the consumer's consent.
From , section 12D-103(b) excludes an insurer, insurance company, insurance producer, surplus lines broker, third-party administrator of self-insurance, health carrier, health services corporation, insurance-support organization or insurance agent, a federal or state-chartered bank, credit union or savings association, and an agent, broker-dealer, investment adviser or investment adviser representative regulated by the Delaware Investor Protection Unit or the Securities and Exchange Commission.
Until , section 12D-103(b)(2) excludes any financial institution or affiliate of a financial institution, as defined in section 6809 of title 15 of the United States Code, to the extent it is subject to Title V of the Gramm Leach Bliley Act. From , an affiliate or subsidiary of an insurer or bank is excluded only if it is principally engaged in financial activities as described in section 1843(k) of title 12 of the United States Code.
Data subject to Title V of the Gramm Leach Bliley Act remains excluded as data under section 12D-103(c)(14). Until , section 12D-108 requires a data protection assessment from a controller that controls or processes the data of not less than 100,000 consumers.
From , section 12D-108 reaches a controller that processes the data of not less than 50,000 consumers, and requires it to conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, including targeted advertising, sale, certain profiling and the processing of sensitive data.
From , a controller of that size must also conduct and document an impact assessment if it engages in profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning a consumer. From , section 12D-106 requires a controller to limit its processing of personal data to what is reasonably necessary and proportional to the disclosed purposes.
From , a controller must enter into a binding contract with each third party to which it discloses personal data, including in a sale or for targeted advertising, that limits the disclosure to specified purposes and obliges the third party to comply with the Act and provide the same level of privacy protection.
From , a controller must also conduct reasonable due diligence of those third parties, which involves at a minimum assessing the third party through questionnaires and review of its relevant documents. From , a contract between a controller and a processor must require the processor to identify each limited and specific purpose for which it processes personal data, described with specificity and particularity rather than in generic terms.
From , a third party that receives personal data from a controller or processor and has no contract required by the chapter may not further process the personal data, and must comply with the terms of any contract the chapter requires.
From , a controller that discloses to a third party a report for use in a decision that produces legal or similarly significant effects concerning a resident must contract with the third party to give the resident notice of any adverse action based on the report, and must give the resident on request, within 30 days, the personal data it maintains, the source of the personal data used in profiling and the third parties that obtained a report within the previous 24 months.
From , evidence or lack of evidence of proactive anti-bias testing or a similar effort to avoid processing personal data in violation of the laws of this State is relevant to any claim for a violation of those laws and to any available defense.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .