Law / United States / 
Delaware
Delaware Personal Data Privacy Act (DPDPA), publicly available information exemption
Del. Code tit. 6, ch. 12D (84 Del. Laws c. 197)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 January 2025.
A personal data rule binding private bodies.
As of 29 August 2026.
What it requires
- Personal data that is lawfully made available through a government record or that a consumer has lawfully made available to the public through widely distributed media falls outside the DPDPA's definition of personal data, so scraping it does not by itself trigger the Act's duties.
- Delaware's applicability thresholds (35,000 consumers, or 10,000 with 20% of revenue from data sales) are lower than several peer states, so check them separately rather than assuming a threshold that clears elsewhere clears here too.
- Cite the Delaware Personal Data Privacy Act at Title 6, Chapter 12D, never Chapter 12C, which is a different, older website-privacy-policy law.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 12D-102(21) defines personal data to mean information linked or reasonably linkable to an identified or identifiable individual and expressly excludes de-identified data or publicly available information.
Publicly available information is defined at section 12D-102(28) as information lawfully made available through federal, state, or local government records, or information a controller has a reasonable basis to believe the consumer has lawfully made available to the general public through widely distributed media.
As in Connecticut, the exclusion operates on the definition of personal data itself, so scraped government-record or public-media personal data is outside the DPDPA's scope by definition rather than by a carve-out from an otherwise-applicable duty.
The Act's applicability threshold is notably lower than several peer states: section 12D-103(a) applies the chapter to persons conducting business in Delaware or targeting Delaware residents who, in the preceding calendar year, controlled or processed the personal data of 35,000 or more consumers (excluding payment-transaction data), or 10,000 or more consumers while deriving more than 20% of gross revenue from personal-data sales.
Chapter 12D's own text at section 12D-101 states this chapter shall be known and may be cited as the Delaware Personal Data Privacy Act; Chapter 12C is instead the Delaware Online and Personal Privacy Protection Act (website privacy policies and children's book-service-provider disclosures). DPDPA's general applicability and controller and processor duties took effect January 1, 2025, the same date the chapter's enforcement notice-and-cure window began running.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
Read the law
official text, Delaware Code Online (delcode.delaware.gov)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.