Law / United States / 
Delaware
Delaware Personal Data Privacy Act (DPDPA), publicly available information exemption
Del. Code tit. 6, ch. 12D (84 Del. Laws c. 197)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator, Independent third party
- Where the report goes
- Produced on request
What it requires
- Personal data that is lawfully made available through a government record or that a consumer has lawfully made available to the public through widely distributed media falls outside the DPDPA's definition of personal data, so scraping it does not by itself trigger the Act's duties.
- Delaware's applicability thresholds are 35,000 consumers, or 10,000 consumers with more than 20% of gross revenue from personal-data sales, until , and 10,000 consumers, or 5,000 with that revenue share, from that date, so check the threshold for the period in question.
- Cite the Delaware Personal Data Privacy Act at Title 6, Chapter 12D, never Chapter 12C, which is a different, older website-privacy-policy law.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does a consumer's post on an openly accessible website or social media profile count as made available "through widely distributed media" under 6 Del. C. section 12D-102(28)?
- Does a controller have a "reasonable basis to believe" that information was "lawfully made available" under 6 Del. C. section 12D-102(28) when the site it was collected from forbids automated collection in its terms of use?
What it makes you log
Who may demand the log
Regulator, Counterparty
What the log must hold
Decision basis
Logging duty
The duty is to conduct and document an assessment that weighs the benefits of the processing against the risks to the consumer, which cannot be shown without a written record. The threshold is 100,000 consumers until and 50,000 consumers from that date, and the 2027 text adds an impact assessment for profiling in furtherance of automated decisions. Section 12D-107(b) also has the processor allow reasonable assessments by the controller or its designated assessor, or by a qualified and independent assessor the processor arranges, and give the controller the assessment report on request.
- Kind
- Implicit
- As of
- Provision
- Del. Code tit. 6, ยง 12D-108(a) and (c): a controller above the consumer-count threshold must conduct and document, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm (targeted advertising, sale, profiling, sensitive data), and must make it available to the Attorney General on request
- Trigger
- personal_data_processing
What this law does
Section 12D-102(21) defines personal data to mean information linked or reasonably linkable to an identified or identifiable individual and expressly excludes de-identified data or publicly available information.
Publicly available information is defined at section 12D-102(28) as information lawfully made available through federal, state, or local government records, or information a controller has a reasonable basis to believe the consumer has lawfully made available to the general public through widely distributed media.
The exclusion operates on the definition of personal data itself, so scraped government-record or public-media personal data is outside the DPDPA's scope by definition rather than by a carve-out from an otherwise-applicable duty; in the version effective the widely-distributed-media limb does not include biometric data that can be associated with a specific consumer and was collected without the consumer's consent.
Until , section 12D-103(a) applies the chapter to persons conducting business in Delaware or targeting Delaware residents who, in the preceding calendar year, controlled or processed the personal data of 35,000 or more consumers (excluding payment-transaction data), or 10,000 or more consumers while deriving more than 20% of gross revenue from personal-data sales; from that date the counts are 10,000 consumers, or 5,000 with that revenue share, and third parties who acquire personal data from a controller are covered too.
Chapter 12D's own text at section 12D-101 states this chapter shall be known and may be cited as the Delaware Personal Data Privacy Act. During calendar year 2025 the Department of Justice had to issue a notice of violation and allow 60 days to cure where a cure was possible, and from it may weigh listed factors in deciding whether to offer a cure.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .