What's Happening?
Delaware Governor Matt Meyer signed HB 380 into law on September 2, 2026, initiating a significant overhaul of the state's data privacy framework. This new legislation, effective January 1, 2027, substantially rewrites the original 2023 Personal Data
Privacy Act (DPDPA) to address previous gaps, particularly concerning data sensitivity, automated decisions, and third-party data flows. The amendments aim to align Delaware's privacy laws more closely with those in states like Connecticut and New Jersey. A key change is the lowering of the consumer applicability threshold to 10,000 Delaware consumers, down from 35,000. For data sales, the threshold drops to 5,000 consumers if those sales generate over 20% of gross revenue, which Delaware claims is the lowest threshold nationwide for triggering state privacy law obligations. The Delaware Department of Justice, specifically the Attorney General’s office, will be responsible for enforcing the DPDPA and remediating violations.
Why It's Important?
This legislative change is crucial for businesses operating in Delaware, especially e-commerce platforms and online services that cater to Delaware consumers. The significantly lowered applicability thresholds mean that many more businesses, including smaller ones or niche services, will now fall under the purview of the DPDPA. This creates a complex compliance landscape for multi-state e-commerce businesses, as the DPDPA will interact with other frameworks like the Fair Credit Reporting Act, GLBA, and EU-style laws such as GDPR. The expanded definition of sensitive data, which now includes neural data, financial credentials, immigration status, and government IDs, will require businesses to re-evaluate their data collection and processing practices. The new law also mandates explicit, informed, and documented consent for processing sensitive data, impacting how companies manage user consent and data usage. Non-compliance could lead to enforcement actions by the Delaware Department of Justice, making readiness by the January 1, 2027, effective date critical.
What's Next?
Businesses serving Delaware consumers must prepare for the January 1, 2027, effective date of HB 380. This involves a thorough reassessment of their data practices, particularly regarding consumer data volumes from 2026, which will determine applicability. Companies need to update their consent mechanisms to ensure explicit consent for sensitive data processing and sales, and to retain these consent records for five years. Third-party relationships will also require scrutiny, as the law mandates precise management of data processors and adtech vendors, with contracts specifying limited data use purposes and DPDPA-level protections. Businesses must also conduct due diligence on third-party data recipients and maintain up-to-date sharing inventories. The expanded consumer rights, including the ability to request a list of named third parties receiving their data, necessitate transparent and accessible data flow documentation. Organizations should integrate Delaware-specific rights handling into their existing global privacy operations to ensure seamless compliance.
Beyond the Headlines
The enactment of HB 380 reflects a broader national trend towards more stringent data privacy regulations, signaling an increasing focus on consumer protection in the digital age. Delaware's move to establish the lowest applicability threshold in the nation for state privacy laws could set a precedent, potentially influencing other states to adopt similar, more expansive regulations. This legislative shift highlights the growing importance of data governance and ethical data handling for businesses. The emphasis on explicit consent for sensitive data and the requirement for detailed third-party disclosures underscore a move towards greater transparency and user control over personal information. This could foster increased consumer trust in businesses that proactively adapt to these regulations, while those that lag may face reputational damage and legal penalties. The law also implicitly encourages the development and adoption of robust consent management platforms and data mapping tools to navigate these complex requirements effectively.
