What Is the Delaware Personal Data Privacy Act (DPDPA): The Basics

The patchwork of US states enacting consumer data privacy laws continues to expand with the Delaware Personal Data Privacy Act (DPDPA).

The law is being touted as "the strongest data privacy bill in the nation." While that's not exactly the case—California still holds this title—it is more consumer-friendly than other state laws, and it applies to more businesses (and not just large companies).

Let's explore the DPDPA and what it means for companies doing business with Delawareans.

What Is the DPDPA?

As a reminder, while there are laws that protect certain types of data, like health information, there's no federal law dictating how personal data is collected, stored, or shared. Not only do consumers not know what data is being collected, they don't know how it's being shared or used.

To address this, states are implementing their own data protection policies, giving consumers rights and providing responsibilities for those that collect, process, store, or sell consumer data.

Delaware is the 12th state in the nation to implement a comprehensive data privacy act to give consumers more control over their personal data. The law took effect Jan. 1, 2025 and provided an additional year to begin recognizing universal opt-out mechanisms. A significant set of amendments to the law takes effect Jan. 1, 2027.

Who Must Comply With Delaware's Privacy Act?

So far, exemptions have left some entities relatively unscathed by state privacy acts. Delaware's privacy act, though, has low applicability thresholds, which means some companies that haven't had to comply in the past will now be on the hook for DPDPA compliance.

As of Jan. 1, 2027, DPDPA applies to any company that does business in the state or produces products or services that are targeted to residents of the state and that, during the previous calendar year, met one of the following:

Controlled or processed the personal data of not less than 10,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.

Controlled or processed the personal data of not less than 5,000 consumers and derived more than 20 percent of their gross revenue from the sale of personal data.

The 10,000-consumer threshold is among the lowest among data privacy laws so far. This, combined with the gross revenue threshold—just 20 percent—means the DPDPA will apply to more small and medium-sized companies than its predecessors. The law also now applies to third parties who acquire personal data from a controller.

 

DPDPA Exemptions  

Like other laws, the DPDPA provides exemptions based on the entity and type of data.

Exempt entities include government bodies, higher education institutions, nonprofit organizations dedicated to preventing insurance crimes and those registered under the Commodity Exchange Act or national securities association registered under the Securities Exchange Act. Financial institutions subject to the Gramm-Leach-Bliley Act (GLBA) are exempt on a narrower basis than before.

The list of exempt data types is longer but is still relatively standard among privacy laws. It includes:

• Protected health information under the Health Insurance Portability and Accountability Act (HIPAA) and certain health information that identifies patients and human subjects or relates to public health activities.

• Financial information that would have a bearing on a consumer's credit, including their credit worthiness, credit standing, capacity, and general reputation.

• Personal data collected, processed, sold, or disclosed in compliance with the Driver's Privacy Protection Act, Family Educational Rights and Privacy Act (FERPA), or Farm Credit Act.

• Data processed for employment purposes or as an emergency contact for another person.

• Price, route, or service data used in the Airline Deregulation Act.

• Personal data of a victim or witness to child abuse, domestic violence, human trafficking, sexual assault, a violent felony or stalking when the information is collected, processed or maintained by a nonprofit that provides services to the victims or witnesses.

• Data subject to the Gramm Leach Bliley Act.
  

Rights the Delaware Privacy Act Grants Consumers 

DPDPA aligns with all other state laws in terms of the rights it grants consumers, including to:

1. Confirm whether a controller is processing their personal data and to access such personal data (unless access would reveal a trade secret), including inferences derived from personal data and whether a controller is processing personal data for profiling to make a decision that produces a legal or similarly significant effect.

    

2. Correct inaccuracies in their personal data.

    

3. Delete personal data provided by or obtained about the consumer.

    

4. Obtain a copy of their data collected in a portable and readily usable format.

    

5. Obtain a list of specific third parties to which the controller has disclosed their personal data.

6. Opt-out of processing of personal data for targeted advertising, sale, or profiling.

Controllers are not required to produce sensitive information, such as Social Security numbers, in response to an access request.

Again, comparable to other laws, the DPDPA gives controllers 45 days to respond to a consumer's request, allows an extension of 45 days in certain circumstances, and requires the controller to notify the consumer if they decline to take action as well as provide instructions for appealing the decision.

Controller Duties Under Delaware’s Privacy Act 

Delaware's privacy law requires controllers to limit the processing of personal data to what is reasonably necessary and proportional in relation to the purposes disclosed to the consumer, and to not process it for any additional purpose that is not reasonably necessary and proportionate to that disclosed purpose, unless the consumer consents.

It also states that controllers must set up safety and security measures to protect personal data of consumers. Companies can't process data if it would enable discrimination, nor can they discriminate against those who exercise their rights.

Controllers must gain opt-in consent to process sensitive data or data of a known child, and that processing must also be reasonably necessary and proportionate to the disclosed purposes. Controllers cannot sell sensitive data unless the disclosure is strictly necessary to a product or service the consumer requested, the controller gives clear and conspicuous notice of the sale beforehand (naming the categories of data, purpose, and third parties involved), the controller obtains consent, and maintains a record of that consent for five years, to be provided with any related data protection assessment.

Controllers must also enter into data processing agreements when transferring personal data to third parties, not just to processors, including a due diligence requirement that specifically involves the use of questionnaires and review of relevant documents of the third party. Third parties that receive personal data without a contract in place may not further process it, and contracted third parties must abide by the contract terms, provide the information controllers need for data protection impact assessments and due diligence, and generally comply with the law.

Finally, controllers must provide consumers with a privacy notice that gives them a clear explanation of what data they collect, how it's used and shared, how to exercise their rights, and how to opt out of the sale of personal data and use of their data for targeted advertising.
Processors, or those who process data on behalf of a controller, must help controllers meet their obligations and be in a contract that governs data processing procedures.

Controllers disclosing a "report" (any written, oral, or other communication of personal data, including recommendations, summaries, or automated decisions) to a third party in connection with a decision producing legal or similarly significant effects concerning a resident must enter into the contractual agreements noted above, notify the resident of any adverse action based on the report, describe the personal data relied upon, explain how the resident can get more information, and offer a human review of the decision where technically feasible, unless doing so isn't in the resident's best interest, such as when a delay could pose a risk to life or safety. "Resident" is broader than "consumer" and includes people in an employment context. Residents can also request, within 30 days, the personal data a controller holds about them, its source, identification of third parties who obtained a report about them in the past 24 months, and the opportunity to correct inaccurate data. Consumer reports regulated under the FCRA are excluded.

The DPDPA and Data Protection Assessments 

Delaware joins several other states that require Data Protection Assessments, including California, Colorado, Connecticut, Indiana. Montana, Oregon, Tennessee, Texas and Virginia.  

If you control or process data of at least 100,000 consumers, Delaware's privacy law says you must conduct a data protection assessment for any activity that presents a heightened risk of harm to a consumer. These activities include:

• Targeted advertising

• To sell personal data

• For profiling if there's a risk of:

• Unfair or deceptive treatment to consumers

• Financial, physical or reputational injury

• Intrusion upon the solitude or seclusion of a consumer (if the intrusion would be "offensive to a reasonable person)

• Processing sensitive data

Controllers that engage in profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning a consumer must also conduct an impact assessment covering the purpose, intended use cases, deployment context, and benefits of the profiling; an analysis of any heightened risk of harm and mitigation steps; the categories of personal data used as inputs and outputs; categories of data used to customize the profiling; performance metrics and known limitations; transparency measures used; and post-deployment monitoring and safeguards.

Enforcement of the Delaware Personal Data Privacy Act 

The DPDPA gives enforcement authority to its Department of Justice (DOJ).

Like other state laws, those who violate the law will be given a right to “cure” the issue. The DPDPA doesn’t specifically outline the penalty for violating the law, but states the Department may “investigate and prosecute violations of this chapter in accordance with the provisions of Subchapter II of Chapter 25 of Title 29.” In other words, if you break the law, the penalty could be up to $10,000 per violation.   

The cure provision, which is 60 days, is only meant to help businesses transition to the law. Like several other state laws, including Oregon, California, Connecticut, and Colorado, Delaware's cure period "sunsets" on Jan. 1, 2026. The idea is that over time, businesses should know and understand their expectations and ensure they're in compliance before they receive an enforcement notice.

After the cure period sunsets, the Department can choose whether to provide a cure period based on several factors, such as the number of violations, size and complexity of the controller or processor, likelihood of injury to the public, and other considerations.

Compliance with the DPDPA 

Many Delaware businesses and companies that operate in multiple states will need to ensure they understand the DPDPA and its requirements for protecting consumer's data. Seek out legal counsel and work to create compliant policies and procedures to meet the law.

If you find your head swirling with all the new and upcoming laws, it may be time to look into Osano’s Consent Management Platform, which can take the headache out of maintaining compliance with not just Delaware’s law, but other state laws and those still on the horizon.   

Delaware Privacy Act FAQs 

What is the DPDPA effective date?  

The Delaware Personal Data Privacy Act went into effect Jan. 1, 2025. A significant set of amendments takes effect Jan. 1, 2027.

How does Delaware’s privacy law define sensitive data and what are the rules?  

Sensitive data is defined as data that reveals:  

• Racial or ethnic origin, or national origin
• Religious beliefs
• Mental or physical health condition or diagnosis
• Sex life
• Sexual orientation
• Status as transgender or nonbinary
• Citizenship status or immigration status
• Genetic or biometric data
• Personal data of a known child (with child defined as those under 13 years of age)
• Precise geolocation data
• Financial information
• Government-issued identification numbers
• Neural data
• Inferences from personal data used to reveal or identify any category of sensitive data

DPDPA states that sensitive data can't be processed without the consumer's (or their parent or guardian's) consent, and that processing must also be reasonably necessary and proportionate to the disclosed purposes.

Does the DPDPA have a private right of action?  

No. When the DPDPA was passed, the only state with a private right of action was California, and only in certain circumstances.  

What does Delaware’s privacy act say about universal opt-out mechanisms? 

Businesses must recognize Global Privacy Controls (GPC) and other universal opt-out mechanisms.