Delaware Significantly Expands Its Privacy Law: What Your Business Should Know

On September 2, 2026, Delaware amended its comprehensive privacy law, the Delaware Personal Information Privacy Act (DPDPA), by signing House Bill 380 (HB 380) into law. HB 380, which goes into effect on January 1, 2027, marks the most significant revision to the DPDPA since its enactment in 2023.

HB 380 lowers the law’s applicability thresholds, narrows certain exemptions, creates new obligations for businesses that receive personal information from covered companies, and expands requirements governing sensitive information, profiling, and automated decision-making.

Businesses that previously determined the DPDPA did not apply, as well as businesses with existing Delaware privacy programs, should review their practices to determine whether the amended law changes their obligations.

More Businesses Will Be Subject to the DPDPA

HB 380 substantially lowers the DPDPA’s applicability thresholds:

The general threshold decreases from 35,000 to 10,000 consumers annually.
The threshold for businesses deriving more than 20% of gross revenue from the sale of personal information decreases from 10,000 to 5,000 consumers.
Certain third parties that receive personal information from a controller may now be subject to the DPDPA without a minimum consumer threshold.

Financial Institution and Other Exemptions Are Narrowed

HB 380 narrows certain exemptions, including:

The GLBA financial-institution exemption is narrowed. HB 380 replaces the broad entity-level exemption with more targeted exemptions for specified financial entities and activities, bringing Delaware closer to California’s approach. Information subject to the GLBA remains exempt, but the exemption no longer automatically extends to all affiliates and subsidiaries.
The employee-information exemption is narrowed. Personal information used in connection with certain profiling and reports in the employment context will now be subject to the DPDPA.

Businesses that previously relied on an entity-level exemption should confirm that the exemption continues to apply after January 1, 2027.

Expanded Protections for Sensitive Information

HB 380 expands the definition of sensitive data to include the following categories, bringing it closer to the CCPA’s definition of sensitive personal information:

Inferences used to reveal or identify sensitive characteristics, including health conditions, religious beliefs, racial or ethnic origin, sexual orientation, or immigration status;
Neural information;
Certain financial account credentials; and
Certain government-issued identification numbers.

Controllers must obtain consent before processing sensitive information, and the processing must be reasonably necessary and proportionate to the purposes disclosed to the consumer.

Sales of sensitive data are also subject to additional restrictions. A permitted sale must be strictly necessary to provide or maintain a product or service requested by the consumer, and the controller must provide clear and conspicuous notice, obtain express consent, and maintain a record of that consent for five years.

New Vendor Due Diligence and Contracting Requirements

HB 380 adds requirements for businesses that disclose personal information to third parties:

Controllers must enter into contracts with covered third parties that limit their use of personal information and include specified privacy protections, including audit and remediation rights.
Controllers must conduct reasonable due diligence, including questionnaires and, where appropriate, additional measures based on the sensitivity of the data and the nature of the processing.
Third parties must cooperate with those diligence efforts and provide information needed for the controller’s assessment.
A third party without a required contract may not further process the personal data it receives and must comply with applicable contractual and diligence requirements.

Businesses should review vendor-management and contracting processes for relationships involving disclosures of personal information to third parties.

Profiling and Automated Decision-Making

HB 380 expands requirements for profiling and automated decision-making:

New requirements apply to certain “reports,” including recommendations, summaries, automated decisions, and other communications based on personal information or profiling.
Where a report is provided to a third party for use in a decision producing legal or similarly significant effects, the controller may need to ensure that the third party provides adverse-action notice, identifies the personal data relied upon, provides information about consumer rights, and offers human review where technically feasible.
The right to opt out of profiling used in connection with automated decisions producing legal or similarly significant effects is expanded by removing the current “solely” automated-processing limitation.

These provisions may be relevant to businesses using AI or other automated tools in employment, financial services, insurance, housing, and other contexts involving significant decisions about individuals.

Assessment Requirements Also Expand

HB 380:

Lowers the threshold for information protection assessments from 100,000 to 50,000 consumers; and
Requires a separate impact assessment for profiling used in furtherance of automated decisions producing legal or similarly significant effects.

The profiling assessment must address, among other things, intended use, foreseeable harms and mitigation, data inputs and outputs, performance and transparency, post-deployment monitoring, and safeguards.

Businesses already conducting privacy or AI impact assessments under other state laws should determine whether those processes can be adapted to address Delaware’s requirements.

Other Changes to Consumer Rights and Privacy Practices

HB 380 makes several additional changes, including:

Consumers generally will be entitled to identify the specific third parties that received their personal information, rather than only categories of third parties.
Controllers must stop processing information subject to withdrawn consent within 15 days.
Controllers must obtain consent from minors ages 13 to 18 before processing their personal information for profiling.
Privacy notices must be reasonably particular to the product or service offered to the consumer, which may require businesses with materially different products or services to reconsider using a single general notice.

What Businesses Should Do Before January 1, 2027

Businesses operating in Delaware or processing Delaware residents’ personal information can use the remainder of 2026 to:

Recheck applicability. Reevaluate the lower consumer thresholds, new third-party provisions, and existing exemptions.
Identify sensitive information and inferences. Determine whether systems generate newly covered sensitive information and whether consent mechanisms remain sufficient.
Review third-party relationships. Identify relevant disclosures and update contracts and diligence procedures.
Inventory profiling and automated decision-making. Identify systems that may trigger the new requirements.
Review assessment requirements. Determine whether existing or planned processing requires an information protection or profiling impact assessment and whether assessments prepared for other states can be leveraged.
Update privacy notices and consumer-rights procedures. Confirm that notices, opt-out mechanisms, consent processes, and rights-request procedures address the amendments.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.