🇺🇸Delaware Personal Data Privacy Act

Skin

← Back to laws in United States

Delaware Personal Data Privacy Act

Delaware Personal Data Privacy Act

The Delaware Personal Data Privacy Act creates a consumer privacy framework for Delaware residents. It follows the controller and processor model used in several US state privacy laws and gives consumers rights over personal data processed by covered controllers. The Act should be read as part of the wider US state privacy landscape rather than as a standalone national privacy code.

For businesses, the Delaware law is important because it includes a broad set of consumer rights, recognises authorised agents for opt-out rights and requires privacy notices, request handling and processor contracts.

Who and what the law protects

A consumer is a Delaware resident acting in an individual context. The definition excludes individuals acting in commercial or employment contexts. The law regulates personal data linked or reasonably linkable to an identified or identifiable individual, while excluding categories such as de-identified data and publicly available information where the statutory conditions are met.

The Act also uses defined concepts such as controller, processor, consent, sensitive data, biometric data, genetic data, targeted advertising, sale of personal data and profiling. These definitions determine whether a business needs opt-outs, consent or additional governance controls.

Key Provisions

Consumer rights: confirm processing, access, correction, deletion, portability, third-party category list and opt-out rights.

Opt-out rights: consumers may opt out of targeted advertising, sale of personal data and certain profiling.

Response timelines: controllers generally must respond without undue delay and not later than 45 days, with a possible 45-day extension where reasonably necessary.

Appeal process: controllers must provide a process for consumers to appeal refusal to act on a request.

Processor contracts: controller-processor relationships should be governed by written terms setting out processing instructions and duties.

Consumer rights handling

Delaware gives consumers meaningful control over their personal data. A consumer may confirm whether personal data is being processed, access it, correct inaccuracies, delete personal data provided by or obtained about the consumer, obtain a portable copy and obtain a list of categories of third parties to whom personal data has been disclosed.

The opt-out right covers targeted advertising, sale of personal data and profiling in furtherance of solely automated decisions that produce legal or similarly significant effects. Parents or guardians may exercise rights for known children, and authorised agents may be used for opt-out rights where the statutory requirements are met.

Privacy notice and controller duties

Controllers should provide a privacy notice that explains what personal data is processed, why it is processed, what is shared, with whom it is shared, and how consumers can exercise their rights. The notice should match the actual processing practices of the organisation.

Controllers should also apply purpose limitation, data minimisation, reasonable security practices and non-discrimination principles. Sensitive data and children’s data should be reviewed carefully because they can trigger consent or child-specific requirements.

Practical risk area

The right to obtain a list of categories of third parties is easy to miss. Vendor and disclosure mapping should identify not only categories of data, but also categories of recipients.

Processor and vendor governance

Delaware’s controller and processor structure means vendor relationships should be documented. Processor contracts should identify the nature and purpose of processing, the type of data, duration, instructions, confidentiality duties, deletion or return obligations and support for consumer request and security obligations.

Controllers should classify recipients correctly. A vendor acting under instructions is different from an independent third party receiving data for its own purposes. This classification affects notice, opt-out and contract requirements.

What this means for you

If you fall under the Delaware law, build a Delaware-ready rights workflow, update the privacy notice, map targeted advertising and sale activity, review sensitive data processing, and ensure processor contracts contain the required operational terms.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis